Welcome to the RingCentral Community

There might be some issue with the JWT token generation for sandbox environment. But it could be also an expected behavior. As for testing your own apps in sandbox environment, you can create a JWT token for all app under your account (sandbox account) instead of creating for a particular app specified by an app client id.

However, since your app is a public app, your customers can generate a production JWT token for that particular app. Though, for public apps, I recommend to use the 3-legged auth flow instead of JWT as it is easier for customer to authenticate the app themselves.