Oauth 2.1 2.4.1 is about client id and secret:
https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#section-2.4.1

To support clients in possession of a client secret, the authorization server MUST support the client including the client credentials in the request body content using the following parameters:

"client_id":
REQUIRED. The client identifier issued to the client during the registration process described by Section 2.2.

"client_secret":
REQUIRED. The client secret.

But I think we want to explicitly reference the Client Credentials grant in 4.2:

The client can request an access token using only its client credentials (or other supported means of authentication) when the client is requesting access to the protected resources under its control, or those of another resource owner that have been previously arranged with the authorization server (the method of which is beyond the scope of this specification).