okta application creation and bearer token generation - okta

Question

I have used the below instructions to create okta application
Create an Okta developer account at https://developer.okta.com/signup/
Set up your application in your Okta account using instructions
at https://developer.okta.com/docs/guides/implement-password/setup-app/. You may name the application "Millenium Care
Inc. API".
Navigate to Directory -> People. Add two users: Joe Intake (jintake#milleniumcare.com) and Joe Adjudicator (
jadjudictor#milleniumcare.com). Use "Set by Admin" option for creating the passwords. Make sure to take note of the
usernames and passwords from this step.
Navigate to Directory -> Groups. Add two groups: "Adjudicators" and "Intake". Add both users Joe Intake and Joe
Adjudicator to the Intake group. Add user Joe Adjudicator alone to the Adjudicators group.
Navigate to the "Manage Apps" option for each group, and add the "Millenium Care Inc. API" application to each group.
Navigate to Security -> API. Under "Authorization Servers", select the "default" authorization server. Select the "
Claims" tab. Add a new claim with the following values:
Name: groups
Included in token type: Access Token
Value Type: Groups
Filter: Matches regex .*
Disable claim: unchecked
Include in: Any scope
Navigate to Applications -> Millenium Care Inc. API. Take note of the Client ID, Client secret and Okta domain.
I used the following command to create bearer token
curl --location --request POST 'https://{{OKTA_DOMAIN}}.okta.com/oauth2/default/v1/token' \
--header 'accept: application/json' \
--header 'authorization: Basic {{CLIENT_CREDENTIALS}}' \
--header 'content-type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=jadjudicator#milleniumcare.com' \
--data-urlencode 'password=Password#1' \
--data-urlencode 'scope=openid'
But when I tried to create a bearer token, I get this
{
"error": "invalid_grant",
"error_description": "The credentials provided were invalid."
}
In step-2, okta's docs tells to create
Select Resource Owner Password as one of the allowed Grant type. But authorization is checked already.
What steps have I missed, or done incorrect?
CLIENT_CREDENTIALS is base64 encoded form of "$CLIENT_ID:$CLIENT_SECRET"
Environment: Windows 10, GIT Bash and/or Postman
FYI. I signed up with company-email which is different than domain in users