Knowledge Base › PDF Signing › Folder Watch (Auto-Signing)

Folder Watch (Auto-Signing)

Apr 5, 2026 · 542 views

Folder watch is the zero-code way to automate signing: drop a file in a folder, get a signed file out. It powers everything from invoice pipelines to network-share signing for whole teams.

How It Works

Two Detection Methods, Combined

  1. FileSystemWatcher — reacts instantly when a file is created in the source folder.
  2. Polling — a safety net that re-scans the folder on an interval (default every 20 seconds, configurable in the SigningEngine tab). This catches files that arrive over network shares or during watcher outages, so nothing is ever missed.

Processing Flow

  1. New file detected in the profile's source folder.
  2. OneSigner waits for the file to finish writing (up to 10 seconds) — partial files are never signed.
  3. A short debounce prevents double-processing when watcher and poller both fire.
  4. The file is signed using the profile's certificate, position and appearance settings. Locked files are retried automatically (up to 10 times).
  5. The signed file is written to the destination folder; the original is removed from the source folder.

Configuration Checklist

  • Engine enabled and the profile switched On in the SigningEngine tab.
  • Separate source and destination folders — pointing both at the same folder causes re-signing loops.
  • Token PIN saved in the profile so no PIN dialog blocks unattended operation.
  • Active user session — USB tokens need an interactive desktop session; enable Auto-Logon for 24/7 servers (why this matters).
  • For code-signing profiles, only the extensions listed in the profile (e.g. .exe,.dll,.msi) are processed.

Feeding the Watch Folder

  • Locally: any app or script that writes PDFs into the folder.
  • Network share: share the source folder — colleagues or servers drop files in, signed results appear in the destination share.
  • API: POST /api/upload lands files in the tenant's upload folder and triggers the same pipeline immediately.

Monitoring

GET /api/signing/status
Authorization: Bearer ADMIN_TOKEN

Returns: engine enabled, active profiles, queue depth, total signed / failed, last sign time and last error. The web portal's Logs page shows the same signing history per file.

Throughput

The USB token is the serial bottleneck (roughly 4 seconds per cryptographic operation on typical tokens), but detection, PDF processing and file handling run in parallel — batches of files dropped together are processed back-to-back without babysitting.