What is the message flow, or sequence that enables JWT encryption of the payload?
(opposed to OAuth / OpenIDConnect which doesn't encrypt the payload)
I downvoted your question due to the fact I believe it to be answered by the canonical resources on JWT, https://jwt.io/introduction/.
Happy to reverse that if I missed some aspect of your question, but I do think you just need to check that link - it seems to cover both your initial question and the follow up in comments
Short answer: RFC 7516
Since it's public key crypto on the latter phase, you need some scheme of PKI to handle public key availability.