Why is jsonwebtoken producing an invalid token?

I am implementing the new Apple Music API.

This API requires a server to generate JSON web token to use as a developer token, so I am using Node JS for this:

var d = new Date();
var seconds = Math.round(d.getTime() / 1000);

var header = {
    "kid": "xxxxx",
    "alg": "ES256
};

var payload = {
    "iss": "xxxxxx",
    "iat": seconds,
    "exp": 86400
};


// sign with RSA SHA256
var cert = fs.readFileSync(path.join(__dirname, '../', 'privatekey/KEY.p8'));  // get private key
var token = jwt.sign(payload, cert, { algorithm: 'ES256', header: header});
res.send(token);

This is supposed to match the structure on App

{
     "alg": "ES256",
     "kid": "ABC123DEFG"
}
{
     "iss": "DEF123GHIJ",
     "iat": 1437179036,
     “exp”: 1493298100
}.

However, the token that this produces is invalid when I try to use it with the API. I receive a 401 error.

via Benr783