In FusionAuth, the access token is always a JWT.

That's what I got wrong then. I thought that if I disable JWT in an application, then FusionAuth will issue some other type of access token. Now it's clear.
Thank you.

So you can always validate it on your own if you like, or use the Introspect, UserInfo or Validate APIs in FusionAuth to tell if you if the JWT is valid.

A FusionAuth invention.
https://fusionauth.io/docs/v1/tech/apis/jwt#validate-a-jwt

The OAuth2 way of doing it.
https://fusionauth.io/docs/v1/tech/oauth/endpoints#introspect

The OpenID Connect way of doing it.
https://fusionauth.io/docs/v1/tech/oauth/endpoints#userinfo

Each of these APIs essentially does the same thing, takes a token and tells you if it is valid. If you're using an OAuth2 library that already knows how to call an Introspect endpoint, use that, if you're using an OIDC library that knows how to call the Userinfo endpoint, use that. If you're writing your own usage, use whatever you want!

We can add the Introspect or Userinfo endpoints to the client library if you like. Here is an issue for Python. https://github.com/FusionAuth/fusionauth-python-client/issues/8

However, because each of these APIs does essentially the same thing, if you're using the client library, you may as well use validateJWT.

However, if you have a resource server which isn't sure about the JWT it receives or really wants to double check it, you can call the introspect endpoint.

Here's more information: https://www.oauth.com/oauth2-servers/token-introspection-endpoint/

PS sorry for pointing you the wrong way about introspect/requests_oauthlib.