How can I correctly format a JWT for Google Cloud Vision API service account authentication in PHP?

I'm trying to authenticate to the Google Vision API using a service account in PHP without relying on the SDK or Composer, as some client servers may not support Composer.

I followed the guide at https://developers.google.com/identity/protocols/oauth2/service-account and generated a JWT which appears valid. However, when I send it to the endpoint, I receive the following error:

{ "error": "unsupported_grant_type", "error_description": "Invalid grant_type: " }

Below is the code I've been using. Despite using what I believe to be the correct grant type, the error persists. What am I missing?

PHPCopied
function base64UrlEncode($text)
{
    return str_replace(
        ['+', '/', '='],
        ['-', '_', ''],
        base64_encode($text)
    );
}

//$headers = [ "alg"=>"RS256","typ"=>"JWT" ];
$headers = array();
$headers["alg"] = "RS256";
$headers["typ"] = "JWT";
$headers["kid"] = "251.........d6";

$headers_encoded = base64UrlEncode(json_encode($headers));

$issuedAt = time();

$payload = 
[
    "id" => random_int(0,9999999999), //gen_uuid(), //   .setId(UUID.randomUUID().toString())
    "sub" => "vision@pw-bottesting.iam.gserviceaccount.com", //Subject
    "iss" => "vision@pw-bottesting.iam.gserviceaccount.com",  //Issuer
    "iat" => $issuedAt,  //Issued at
    "exp" => $issuedAt + 3600,
    "target_audience" => "https://vision.googleapis.com/v1/images:annotate",
    "scope" => "https://vision.googleapis.com/v1/images:annotate",
    "aud" => "https://www.googleapis.com/oauth2/v4/token"
];

$payload_encoded = base64UrlEncode(json_encode($payload));

/*
//build the signature  hmac
$key = 'secret';
$signature = hash_hmac('sha256', "$headers_encoded.$payload_encoded",
$key, true);
$signature_encoded = base64UrlEncode($signature);

//build and return the token
*/

//build the signature
$key = "-----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----\n";
openssl_sign("$headers_encoded.$payload_encoded", $signature, $key, 'sha256WithRSAEncryption');
$signature_encoded = base64UrlEncode($signature);
$token = $headers_encoded.$payload_encoded.$signature_encoded;

//echo $token;

$ch = curl_init("https://www.googleapis.com/oauth2/v4/token");
$header = array();
//$header[] = "Authorization: Bearer " . $token;
$header[] = "Content-Type: application/x-www-form-urlencoded";

$rbody = Array();
$robody["assertion"] = $token;
//$robody["grant_type"] = urlencode("urn:ietf:params:oauth:grant-type:jwt-bearer");

//$robody = json_encode($rbody);
$robody = "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=" . $token;

curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $rbody);

$out = curl_exec($ch);
if (curl_error($ch)) {
    echo "ERROR:
" . curl_error($ch);
} else {
    echo $out;
}
curl_close($ch);