@Evert So in short, access token isn't required to be JWT, but ID token is.

If the access token is not JWT, then how can my backend verify it? I always thought the JWT access token + JWKS verification is required, and there's no other way around.