Proper sample for two-legged auth for service account and consume google resources in server side

Can't find a proper example for using goolge services like calendar by using 2LO auth for service accounts.
Having difficulties authenticating the the app engine client (Showing invalid grant after using this
const auth = new google.auth.GoogleAuth({
scopes: ['https://www.googleapis.com/auth/calender', 'https://www.googleapis.com/auth/calendar.events', 'https://www.googleapis.com/auth/calendar.events.readonly', 'https://www.googleapis.com/auth/calendar.readonly', 'https://www.googleapis.com/auth/calendar.settings.readonly'],
}
auth.

Also when tried to manually create jwt tokens, always getting invalid signature, I feel the documentation for this @ https://developers.google.com/identity/protocols/oauth2/service-account is not clear enough to perform either manually or by using google libraries

Any help would be appreciated, thanks