> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FXCL application encryption

> Use the Futurex Client Library C++ and Java APIs with CryptoHub key stores, local application encryption, remote cryptographic operations, and tokenization profiles.

The **Futurex Client Library (FXCL)** gives C++ and Java applications a native object model for CryptoHub key stores, encryption keys, cryptographic operations, and tokenization profiles. FXCL connects to the CryptoHub Native Host API over TLS.

This guide covers FXCL 1.9.5 with CryptoHub 7.2.0.x. It is separate from the CryptoHub Client Library PKCS #11 and CNG providers, which connect through the CryptoHub REST API.

## Explore FXCL application encryption

<CardGroup cols={2}>
  <Card title="Install and authenticate FXCL" icon="download" href="./install-and-authenticate">
    Install the matching native and Java packages, configure TLS, and authenticate a Host API session.
  </Card>

  <Card title="Manage keys and encrypt with C++" icon="braces" href="./manage-keys-and-encrypt-with-cpp">
    Create, rotate, and delete an AES key store, then encrypt data locally.
  </Card>

  <Card title="Manage keys and encrypt with Java" icon="coffee" href="./manage-keys-and-encrypt-with-java">
    Use the JNI-backed API for local and CryptoHub-backed encryption.
  </Card>

  <Card title="Configure tokenization profiles" icon="scan-line" href="./configure-tokenization-profiles">
    Configure client-side and CryptoHub-backed format-preserving encryption.
  </Card>

  <Card title="API reference" icon="book-open" href="./api-reference">
    Find the C++ and Java classes for each application-encryption task.
  </Card>

  <Card title="Troubleshoot FXCL" icon="wrench" href="./troubleshoot-fxcl">
    Diagnose TLS, authentication, key-store, token-profile, and HSM license errors.
  </Card>
</CardGroup>

## The application encryption model

FXCL supports two execution models:

| Model            | Key-store setting | Where the operation runs        | Use when                                                            |
| ---------------- | ----------------- | ------------------------------- | ------------------------------------------------------------------- |
| Client-side      | Retrievable       | In the application process      | The application needs local throughput or local FF3-1 tokenization. |
| CryptoHub-backed | Non-retrievable   | On CryptoHub and its Anchor HSM | The key must remain under CryptoHub and HSM control.                |

The application always uses CryptoHub to create, identify, rotate, and authorize the key store. The key-store configuration determines whether FXCL can retrieve the active key for a local operation.

<Warning>
  A retrievable key can enter application memory. Use this model only when the endpoint and application process are inside the approved security boundary. Use a non-retrievable key store when the key must not enter client memory.
</Warning>

## Connection and trust flow

1. The application loads the FXCL native library.
2. `KeyServer` connects to the CryptoHub Native Host API over TLS on port 2001.
3. The application verifies the CryptoHub production CA and expected server identity.
4. A Client Application API key, user login, PKI login, or JWT establishes the authorized Host API context.
5. FXCL sends key-store, cryptographic, or token-profile commands through that context.
6. CryptoHub applies the identity, partition, key-store, and HSM policies before it returns a key or operation result.

## Choose an interface

Use FXCL when the application needs the FXCL key-store and token-profile object model.

Use another CryptoHub interface when it fits the application better:

* Use the [CryptoHub PKCS #11 module](../CryptoHub_PKCS11_developer_guide/Overview) for a standard Cryptoki integration.
* Use the [CryptoHub CNG provider](../CryptoHub_CNG_developer_guide/Overview) for the Windows CNG key ecosystem.
* Use the [REST cryptographic operations](/REST_API/Docs/Cryptography/Cryptographic_operations_model) for a language-neutral HTTP integration.
* Use KMIP when the application already implements a standards-based KMIP client.

## Version and scope

This guide is validated with:

* FXCL 1.9.5 for Linux AMD64 and OpenSSL 3
* CryptoHub 7.2.0.7
* Ubuntu 22.04
* GCC 11
* OpenJDK 17

CryptoHub 7.3.0.x, Windows, macOS, Python, C#, high availability, concurrent-session limits, throughput, and offline cache behavior are outside this validated scope.


## Related topics

- [Create an application partition for Futurex PKCS #11](/Integrations/HSM/Generic/Generic_Futurex_PKCS_11/Configure_the_Vectera_Plus/Create_an_application_partition_for_Futurex_PKCS_11.md)
- [Create an application partition](/Integrations/HSM/VPN/OpenVPN_Access_Server/Integration_Steps/Configure_the_Vectera_Plus/Create_an_application_partition.md)
- [Create an application partition for Ansible](/Integrations/HSM/IT_automation_and_orchestration/Ansible/Configure_the_Vectera_Plus/Create_an_application_partition_for_Ansible.md)
- [Create a new identity and associate it with the new application partition](/Integrations/HSM/Generic/Generic_Futurex_PKCS_11/Configure_the_Vectera_Plus/Create_a_new_identity_and_associate_it_with_the_new_application_partition.md)
- [Install and configure the FXCL CNG](/Integrations/KMES_Series_3/Endpoint_management/Microsoft_Intune/Install_and_configure_the_FXCL_CNG.md)