SAML SSO vs OAuth Client Credentials for API calls

Switched the org to SAML SSO only. The admin login works fine but the backend scripts using client credentials grant are failing with 401.

POST /oauth/token
{
 "grant_type": "client_credentials",
 "client_id": "...",
 "client_secret": "..."
}

Is the client credentials flow disabled when SAML is enforced or am I missing a config step?