update

Author: vicancy

articles/azure-web-pubsub/concept-client-protocols.md

@@ -31,12 +31,14 @@ Here is a general authorization workflow:
 
 You could also configure additional properties for the client connection when generating the access token by specifying special claims inside the JWT token:
 
-| Property | Claim type | Claim value | Notes |
-| --- | ---| --- |
-| The `userId` that the client connection belongs to | `sub` | `{userId}`` | It is the [user](./key-concepts.md#terms) this connection belongs to. You could use `SendToUser` to send messages to the connections belonging to this user |
-| The lifetime of the token | `exp` | the expiration time of the token | |
-| The [permissions](#permissions) the client connection initially has | `role` | List of roles as listed in [permissions](#permissions) | |
-| The initial groups that the client connection joins once it connects to Azure Web PubSub | `group` | List of groups the client joins initially | |
+| Description | Claim type | Claim value | Notes |
+| --- | ---| --- | -- |
+| The `userId` for the client connection | `sub` | the userId | Only one `sub` claim is allowed |
+| The lifetime of the token | `exp` | the expiration time | The `exp` (expiration time) claim identifies the expiration time on or after which the token MUST NOT be accepted for processing. |
+| The [permissions](#permissions) the client connection initially has | `role` | the role value defined in [permissions](#permissions) | Specify mulitple `role` claims if the client has multiple permissions |
+| The initial groups that the client connection joins once it connects to Azure Web PubSub | `group` | `{groupToJoin}` | Sepcify multiple `group` claims if the client joins multiple groups|
+
+You could also add custom claims into the access token, and these values are preserved as the `claims` property in [connect upstream request body](./reference-cloud-events.md#system-connect-event).
 
 [Server SDKs](./howto-generate-client-access-url.md#generate-from-service-sdk) provides APIs to generate the access token for the clients.