How to Verify a Peptide COA and Vet a Vendor

Three semaglutide vials bought online, each labeled around 99 percent pure, came back at 7.7, 9.0, and 14.4 percent actual purity when a lab ran them (PMID 39509151). Every one held more active drug than the label claimed, by 28 to 39 percent, and all three carried measurable bacterial endotoxin. That 2024 analysis in the Journal of Medical Internet Research is a clean snapshot of the research-peptide gray market, where the label and the reality often have little to do with each other.

For any research material, sourcing is the one variable you fully control. You can't rewrite the science on a compound. You can decide which supplier's vial ends up on the bench, and whether its paperwork holds up. A Certificate of Analysis is the tool for that decision. It only helps if you know how to read one and, more important, how to verify it.

This guide covers both, and builds on the storage, sourcing, and safety guide rather than repeating it.

Most of these compounds ship under a Research Use Only label. That's a real regulatory category (21 CFR 809.10), and it carries a specific consequence. Research-use-only material sits outside the rules that govern approved injectable drugs. No premarket review, no mandatory Good Manufacturing Practice, no required sterility or endotoxin release testing. The label still has to carry a lot number tied to manufacturing, but the pharma-grade guardrails don't apply.

Regulators have been active here. Through late 2024, the FDA issued warning letters to firms selling peptides, including semaglutide, tirzepatide, retatrutide, and BPC-157, that used research-use-only labels while advertising human use. The agency applies an objective-intent standard, so a disclaimer doesn't override how a product is marketed.

The takeaway is responsibility, not alarm. When manufacturing standards are optional, the certificate and its verification become the buyer's job. And the gray-market track record is uneven. A 2018 Talanta analysis of falsified peptides from illegal online pharmacies found purity ranging from 5 to 75 percent, plus inorganic arsenic at up to ten times the parenteral limit and detectable lead (PMID 30029448). Melanotan II vials labeled 10 milligrams have measured at 4 to 9 milligrams of actual peptide, every one under label (Breindahl, 2015).

A Certificate of Analysis, or COA, is a lab report for a specific batch of material. A real one lists the tests run, the method behind each test, the specification it had to meet, and the measured result. Good ones name the lab and carry a report or accession number you can look up.

One thing gets missed constantly. A COA proves something about the sample the lab tested. It doesn't automatically prove anything about the vial in your hand. Those match only if the batch and lot on the certificate match the batch and lot on your vial, and if the certificate came from an independent lab rather than a marketing folder.

Purity numbers on a product page are marketing until a batch-specific certificate backs them. The gap between a '99 percent pure' headline and a matching, verifiable lab report is where most quality problems live.

Most legitimate peptide COAs run four tests. Each answers a different question, and each has a limit worth knowing.

HPLC purity measures how much of the sample is a single species. Reversed-phase high-performance liquid chromatography, run under USP General Chapter 621, separates the main peak from related impurities. It answers how uniform the sample is, not what it is. A wrong compound that happens to be pure will still post a high purity number, so purity alone never confirms identity.

Mass spectrometry identity confirms what the molecule actually is. Electrospray ionization mass spec reads the molecular weight, the compound's mass fingerprint, and matches it against the expected value. Its limit matters. Mass alone can't tell apart stereoisomers or sequence variants that share the same weight. Identity and purity together are far stronger than either one.

LAL endotoxin checks for bacterial pyrogens. The Limulus Amebocyte Lysate assay, standardized in USP 85, detects gram-negative endotoxin. One nuance trips people up. There's no universal pass number in endotoxin units per milligram, because the real limit depends on the intended dose, calculated as K over M. A raw figure on a certificate means little on its own, and this test checks pyrogens, not live microbial contamination, which is separate.

Amino acid analysis and net peptide content measure how much of the vial is actually peptide. This is quantity, not quality. It separates real peptide mass from the water and counterion salts, like acetate or trifluoroacetate, that come along with it.

Purity and net peptide content answer two different questions, and confusing them is common.

Purity is the fraction of the peptide present that is the correct peptide. Net peptide content is how many milligrams of actual peptide sit in the vial, after subtracting salt, water, and residual solvent. A vial can read 99 percent pure on HPLC and still hold far less peptide by mass than the label suggests, because purity says nothing about fill weight.

A certificate that reports both is doing more work than one that reports purity alone. When a COA lists net peptide content above the label amount, the vial was slightly overfilled. When it stays silent on content, you know the quality of the peptide but not the quantity. For the hands-on side of measuring and mixing what you receive, the reconstitution guide has the syringe math.

Two identifiers show up on peptide labels, and they do very different jobs.

A CAS Registry Number identifies the substance. It's a unique code assigned to a chemical, and it's the same everywhere, for every producer and every batch. GHK-Cu carries the same CAS number no matter who made it. A CAS number answers what compound this is, and nothing more.

A lot or batch number identifies the production run. The manufacturer assigns it, and it ties one physical unit back to one manufacturing event. Two vials of the same compound made months apart share the CAS number but should carry different lot numbers.

This is why it matters. A certificate has to match the lot on your vial, not just the CAS. A correct CAS confirms the vendor intended the right compound. Only the lot number tells you whether the specific batch you received was the one that got tested. The peptide glossary has quick definitions if a term here is new.

A fast check separates real batch tracking from theater. A legitimate lot number belongs to one product and one production run. So search the vendor's COA library for the lot number printed on your vial, and count how many distinct products come back.

One product, one or a few sizes, one date range? That looks like a real batch. The same lot number attached to twenty, thirty, or fifty different compounds across several months? That's not a batch number. That's a shared testing or shipment code wearing a lot number's clothes.

The distinction isn't academic. When a single code covers an entire catalog, searching by lot tells you nothing about your specific vial, because the code doesn't point to a single run. The paperwork can look full and still float free of what you're holding.

Anyone can generate a PDF with plausible numbers. Fabricated chromatograms and mass spectra that pass a casual glance are now trivial to produce. So the goal is verification, not trust.

The strongest signal is a report you can confirm on the testing lab's own server. Independent labs that publish an accession number or a QR code let you type that number into the lab's database and pull the same result, outside the vendor's control. A vendor can fake a certificate. A vendor can't create a matching entry in a third-party lab's system.

That points to a few habits. Prefer suppliers who use a named, independent analytical lab over in-house-only testing. Check that the accession number or QR on the certificate resolves in the lab's database, and that it resolves to your product and your lot. A missing accession number, a dead QR code, or a code that opens a different product is the tell.

One order, examined closely, shows how this plays out. Names are left out. The pattern is the point.

The order was five items. Two arrived as the wrong compound entirely. A healing blend came as a single unrelated peptide, and a growth-hormone combo arrived as a different variant with one of its two ingredients missing. That alone is a fulfillment failure, before any lab question.

Then the certificates got interesting. One vial's lot number, searched in the vendor's own library, pulled up a certificate for a completely different peptide. The physical product was one compound; its lot resolved to another. Next, one lot number returned roughly fifty different products across several months of report dates, the shared-code pattern from above. And one vial carried no QR code at all, so there was no way to confirm it against the lab.

The reassuring half. When individual reports were opened, several were real. One certificate carried a genuine mass spec with a molecular weight that matched the compound, and the numbers were internally consistent. The testing itself looked legitimate.

The lesson holds both truths at once. Lab work can be real and tracking can still be broken. If the lot on your vial doesn't resolve to a matching, product-specific certificate, you can't verify that vial, no matter how good the vendor's other paperwork looks.

A handful of signals separate careful suppliers from careless ones.

One lot number across many products. If a searched lot returns a whole catalog of different compounds, it's a shipment code, not a batch identifier.

A certificate that names a different product or size. The COA has to match both the compound and the lot on your vial. A near-match is a miss.

Purity only, with no identity or content. HPLC purity without a mass spec identity test and net peptide content leaves the two most useful questions unanswered.

In-house testing with no independent lab. A named third-party lab with a searchable database beats a vendor's own unverifiable report.

No accession number, or a dead QR code. If the certificate can't be confirmed on the lab's server, treat it as unconfirmed.

Stale or missing dates. A certificate from years ago, or with no report date, doesn't describe fresh material.

Mismatches happen, and the response is direct. Ask the supplier for a current, product-and-lot-specific certificate with an accession number you can verify on the testing lab's database. If the vendor also shipped the wrong item, document it with photos of the vials and labels next to the order.

If a supplier can't produce a certificate that matches the exact lot on your vial, the honest position is that the material is unverified. Real testing on some other batch doesn't transfer to the unit in front of you. A cooperative vendor will reship the correct product and provide matching documentation without much friction.

Run this before ordering, not after.

Confirm the supplier uses a named, independent lab and publishes accession numbers or QR codes. Search a sample lot number in their library and check that it returns one product, not fifty. Open a certificate and confirm it lists HPLC purity, mass spec identity, endotoxin, and net peptide content, each with a method and a specification. When the vial arrives, match its lot number to a certificate for that exact product, and confirm the accession number resolves on the lab's own site.

None of this makes a research compound safe or approved. It tells you whether the material matches its documentation, which is the one question a buyer can actually answer. The beginner's guide and the storage and safety guide cover what to do with material once you trust it.