> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prepare CryptoHub

> Deploy the AppViewX service, create an endpoint, and create the key group.

AppViewX authenticates to CryptoHub as the identity a service endpoint provisions, and the keys it generates land in a key group you designate. Deploy the AppViewX service and create those objects before you configure AppViewX.

## Deploy the AppViewX service and create an endpoint

Deploy the AppViewX service and create an endpoint for it. Creating the endpoint provisions the scoped partition and identity AppViewX authenticates as, grants that identity only the permissions the integration needs, and authorizes the Host API commands it sends. The endpoint is a REST API endpoint, so the identity can authenticate over the CryptoHub REST API (`/home/v1/login`) with no further identity configuration. You do not create the partition, grant its permissions, enable the commands in **Host API Options**, or enable REST API login by hand.

<Steps>
  <Step>
    Log in to the CryptoHub under dual control with your administrator identities.
  </Step>

  <Step>
    On the **Services** page, select the **AppViewX** service and select **\[ Deploy ]**. Accept the default **Service Name** and **Service Category**, step through **Access Control** and **Service Info**, and select **\[ Deploy ]**.

    Deploying the service creates a partition scoped to this integration and grants it only the permissions the integration needs: `CertManage:Add`, which authorizes the key pair generation command (`RKPK`), and `Keys:Export`, which authorizes the CSR generation command (`RKOP:request`).
  </Step>

  <Step>
    Open the **Endpoints** menu for the AppViewX service and select **\[ Add New ]**. Enter an identifier or leave it blank for auto-generation, leave the CryptoHub **Hostname** as is, and select **\[ Add Endpoint ]**. The browser downloads a bundle for the endpoint.

    The endpoint authorizes the Host API commands the integration sends, `RKPK` and `RKOP:request`.
  </Step>

  <Step>
    Record the endpoint's username and password from the downloaded bundle. You store both in the AppViewX vault in [Configure AppViewX to authenticate to CryptoHub](/Integrations/CryptoHub/Certificate_management/AppViewX/Integration_steps/Configure_AppViewX_to_authenticate_to_CryptoHub).

    <Warning>
      Treat the endpoint password as a secret. Store it only in the AppViewX vault, and do not place it in workflow definitions, scripts, or logs.
    </Warning>
  </Step>
</Steps>

For the standard service deployment and endpoint flow this integration follows, see [Service guides](/Integrations/CryptoHub/Service_guides/Service_guides).

## Create the key group

The generated key pairs are stored in a key group, which acts as both a container for keys and a template for the keys created in it. For details, see the key groups section in [About the key database](/CryptoHub/7.3.0.x/Administrator_guide/Classic_tools/Key_Database/About_key_database).

Create a key group for this integration and record its name. AppViewX passes the name when it generates each key pair.

<Note>
  Because the key group acts as a template, its settings constrain the keys created in it. Confirm the group permits the RSA modulus sizes you intend to use before you run the integration.
</Note>

## Next steps

Configure AppViewX to authenticate with the endpoint credentials. See [Configure AppViewX to authenticate to CryptoHub](/Integrations/CryptoHub/Certificate_management/AppViewX/Integration_steps/Configure_AppViewX_to_authenticate_to_CryptoHub).