Answer
A dedicated Service User (rather than a regular named user account) is the standard account type for this — it's meant specifically for non-interactive, application-to-application API access. IFS's own extensibility documentation includes a get-started/quickstart section on setting up authentication and the initial OAuth-based Postman setup, which is the right starting point for working out the full client-credentials configuration end to end.