OAuth 2.0 does not define the format. Opaque tokens are validated by asking the authorization server (token introspection, RFC 7662), which allows instant revocation. JWT access tokens are validated locally; RFC 9068 profiles them with typ at+jwt and required claims iss, exp, aud, sub, client_id, iat and jti, plus scope.
Resource servers must check audience and scope, not just the signature, and treat tokens as bearer credentials unless they are sender-constrained with DPoP or mTLS. Clients should treat access tokens as opaque even when they happen to be JWTs, since the format can change.