My understanding is that tokens are signed by server and every time a client makes a request with the token, the server decrypts it to get the user info.
A couple of problems I see about calling this stateless:
1) Is there one private key for all users? If it's different, you are maintaining all the private keys instead of session information.
2) Once the server decrypts the token, lets say the decrypted message is a JSON blob with fields like id,username
on it. How will the server know whether or not that id, username
exists on their platform without maintaining that in the first place?