Obtain an access token using the OAuth2 client_credentials grant. Send your client_id and client_secret. Returns an RS256-signed JWT; the scope claim is a space-separated list of ACLs and no refresh token is returned.

Requires the x-api-key header on this request itself, not just on the downstream FHIR calls that follow. Omitting it still returns a 200 with a valid-looking token, but every downstream FHIR call then fails. This is the x-api-key provisioned for your client_credentials vendor application — a different value than the one used with the legacy password grant.