you will be using both PKCS#11 and CryptoAPI functionalities.
PKCS#11 will be primarily used to talk to the hardware token. Every hardware vendor would have implemented a PKCS#11 interface for their hardware token. If your's is etoken,then safenet has one. Also safenet will have their CryptoAPI CSP that you can use to talk to the token.
CryptoAPI provides rich functionality to handle certificates that are present with in the token.