SAML SSO breaking client_credentials OAuth flow

We switched our org to SAML SSO last week. The login page works fine for humans, but our internal scripts are dead. I’m trying to keep using the client_credentials grant type for our backend jobs that pull queue stats, but the token endpoint is rejecting the request now.

POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=<my_id>&client_secret=<my_secret>

I get a 401 Unauthorized. The error payload says invalid_client. I checked the app settings in the admin UI and the secret is still there. I tried adding username and password to the body just in case, but that didn’t help either. Is the SAML switch supposed to kill the machine-to-machine auth? I don’t want to rewrite all our Python scripts to use a different grant type if I don’t have to. The docs are vague on this specific combo.