RFC 7515 §4.1.9 defines it; RFC 7519 recommends JWT. RFC 8725 §3.11 recommends explicit types for every new token kind, and the specifications followed: OAuth JWT access tokens use at+jwt (RFC 9068), DPoP proofs dpop+jwt (RFC 9449), SD-JWT key-binding JWTs kb+jwt (RFC 9901), Security Event Tokens secevent+jwt (RFC 8417).
Verifiers should require the exact typ they expect (compared case-insensitively, with an optional application/ prefix) in addition to audience and issuer checks. Otherwise an ID token, a logout token or a DPoP proof signed by the same key might be replayed as an access token. Do not confuse typ with cty, which describes the payload, as in nested JWTs.