Access have no relation to sessions. A session is an association of a person to a web browser. An access token is the authorization of a client (i.e. a piece of software) to call an API (as designated by the presence of scopes in the access token). Access tokens are as good until they expire. 24 hours is an unusually long time for an access token. Best practices is 1-5 minutes. What I would recommend is a short lived access token, with a refresh token that lives for 24 hours. This would better maintain the security profile.

thanks - What about web session expire duration and gluu login token expire duration 1. gluu login token expire duration 2. refresh token expiration - set to 24hrs 3. web session expire duration

Web session expiration is up to you. Google never expires your web session... I'm not sure what "login token expire" duration refers to.