OAuth 2.0. No session? (stateless)

I'm going to implement OAuth 2.0 and REST API with it

to grant different permissions per users and also to scale well.

To scale well, stateless is easier because there is

NO file, database, in-memory based session with it.

Below is how I understand OAuth 2.

1. OAuth Server give an access token to a user.
2. The user's access token is stored in cookie.
3. When user access to REST API, user sends with the access token.
4. Server receives request with access token.
5. Server find out whether access token is valid and the user has permission to do request.
6. Do or reject based on user's privilege.

So I do not have to worry about session storage. Right?