here's the jwt document for google for web apps
here's the jwt document for google for service accounts
for web apps, the following fields are mandatory (but the netkit documentation says they're optional)

• response_type isn't mentioned in the netkit docs, but it's mandatory
• scope (no mention for google - but it's mandatory for both web apps and service accounts)