The OAuth2 spec (http://tools.ietf.org/html/rfc6749) says that these bearer tokens are supposed to be used by including them verbatim in the request (as headers, query-args, or form-data). Which means the server can store hashed forms of them, just like your `sha256(token)`.

(With HAWK requests, the client is given a secret `key` and a non-secret `id`, and it makes HTTP requests that include a header with `id, HMAC(key, request)`. The server sees `id`, looks up `key` in a table, computes its own HMAC of the request using that key, then compares the HMAC against the header. That means an eavesdropper who hears the request cannot create other valid requests. But it also means the server must store the actual `key`, which means someone who reads the server's database can forge requests.)