How does a resource server validate a JWT access token without calling the Authorization Server on every request?

The resource server fetches the Authorization Server's public signing keys once via the JWKS (JSON Web Key Set) endpoint and caches them, then verifies each incoming JWT's signature locally using those cached public keys — since JWTs are self-contained and signature-verifiable, no per-request network round-trip to the Authorization Server is needed (unlike opaque tokens, which require an introspection call every time).