...
BASE64URL(UTF8(JWS Protected Header)) || '.' ||
BASE64URL(JWS Payload) || '.' ||
BASE64URL(JWS Signature)
...
Notes:
An JWK with an existing kid is skipped as you can't update an specific key. To do an update the existing key must be removed and a new defined.