Okay... again just encase anyone comes across this... It looks like the client credentials flow doesnt support JWT tokens by default, instead you must use opaque tokens or optionally use Ory Oathkeeper. This can be found here.