SAML SSO breaking Programmatic OAuth Client Credentials

Can’t seem to get the config right for SAML SSO for users while keeping our Five9 migration scripts alive. We enabled SAML in the Org settings, but our Data Actions using the client_credentials grant type now return 401 Unauthorized when calling /api/v2/oauth/token. The docs say SAML should not affect service accounts, but our Python SDK client is failing immediately after the toggle.

client = purecloud.auth.client_credentials(
 client_id="our_service_account_id",
 client_secret="our_secret"
)
# Returns 401

Is there a specific permission set or API call needed to whitelist service accounts post-SAML setup? Genesys Docs