SAML SSO breaking programmatic OAuth client credentials

Switched the org to SAML SSO. Now the Python SDK genesyscloud.auth.client_credentials() call throws 401.

auth = genesyscloud.auth.client_credentials()
access_token = auth.get_access_token()

Is there a specific endpoint or header change needed to keep the service account working while users log in via SAML? Docs are vague on this hybrid setup.