Access MS365 files using Sharepoint python API + client credentials

I'm trying to read the content of an Excel file stored in OneDrive, via the Sharepoint python API. I've seen a couple of examples for usr/pwd authentication, but none using app credentials (client_id/client_secret).

(1) I created credentials on the sharepoint site using
https://MYDOMAIN.sharepoint.com/sites/engineering/_layouts/15/appregnew.aspx

(2) I gave permissions to the credentials using:
https://MYDOMAIN-admin.sharepoint.com/_layouts/15/appinv.aspx

<AppPermissionRequests AllowAppOnlyPolicy="true"><AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read" /></AppPermissionRequests>

(3) Then I tried the following code snippet:

from office365.sharepoint.client_context import ClientContextfrom office365.sharepoint.client_context import ClientCredential# sharepoint app: https://outlyer.sharepoint.com/sites/engineering/_layouts/15/appregnew.aspxclient_id = "..."client_secret = "..."site_url = "https://MYDOMAIN.sharepoint.com/"client_credentials = ClientCredential(client_id, client_secret)ctx = ClientContext(site_url).with_credentials(client_credentials)web = ctx.webctx.load(web)ctx.execute_query()print("Web title: {0}".format(web.properties['Title']))

This returns an authentication error:

requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://MYDOMAIN.sharepoint.com/_api/Web

Any ideas? The MS docs are super cryptic to me, especially as they are apparently many different scopes / methods where app permissions can be handled.