How to Vet a Peptide Source: A Safety and COA Checklist

TL;DR

Vetting a peptide source means checking who is accountable for the product, what was tested, who tested it, and whether that testing matches the exact batch in your hands. A certificate of analysis, or COA, is one piece of that picture. It is not a safety certificate.

The safest path is a prescription filled at a state-licensed pharmacy. Products sold as “research use only” are not approved medicines, and FDA has repeatedly said that label does not change what the product is when it is marketed for human use. This PeptIQ.io guide gives you a neutral checklist, explains what a COA can and cannot prove, and lists the red flags that should end the conversation. It does not recommend any seller. Talk to a licensed clinician before using any peptide.

Why Sourcing Matters

Peptide marketing tends to look the same whether the product is an approved medicine, a compounded preparation or a vial with no regulatory review at all. The paperwork behind those products is not the same.

FDA's current guidance on unapproved GLP-1 products says the agency has warned companies that sold unapproved semaglutide, tirzepatide and retatrutide products “falsely labeled ‘for research purposes’ or ‘not for human consumption,’” and urges consumers not to buy them because they “may be harmful to their health.” The same page says counterfeit drugs can contain “the wrong ingredients,” too little or too much active ingredient, or none at all. FDA: concerns with unapproved GLP-1 drugs.

The warning letters are specific. In a March 2026 letter and an August 2026 letter, FDA told online sellers that “evidence obtained from your website establishes that your products are intended to be drugs for human use,” despite “research use only” labels. The evidence cited was ordinary marketing: product pages describing weight, glucose or hormone effects, plus bacteriostatic water sold alongside the peptides. FDA treated the products as unapproved new drugs.

PeptIQ.io has covered this shift in detail. Read the FDA warning letters explainer for the regulatory picture and the counterfeit retatrutide guide for what has happened with one investigational compound. This page is the practical layer: the questions to ask before you trust any source.

Prescription vs Compounded vs “Research Use Only”

Three legal categories cover almost everything sold as a peptide. The category determines who is accountable, what testing is required, and what a COA can reasonably promise.

• FDA-approved prescription products. Approved on the basis of clinical trial evidence, manufactured under federal quality rules, and dispensed by a licensed pharmacy against a prescription. FDA's advice is direct: “Patients should obtain a prescription from their doctor and fill the prescription at a state-licensed pharmacy.”
• Compounded preparations. Made by a licensed pharmacist or physician for a patient, or by an FDA-registered outsourcing facility. FDA states that “compounded drugs are not FDA-approved” and that the agency “does not review their safety, effectiveness or quality before they are marketed.” State boards of pharmacy “have primary responsibility for the day-to-day oversight” of traditional compounding pharmacies, while outsourcing facilities are inspected by FDA and must follow current good manufacturing practice. FDA compounding Q&A. PeptIQ.io's 503A vs 503B guide explains the categories.
• “Research use only” products. No prescription, no pharmacy license, no pre-market review and no regulator checking the label matches the vial. The label describes the seller's claimed intent, not the product's quality. FDA has said that once a seller markets such a product for human effects, the label does not protect the seller or the buyer.

Verifying a pharmacy

If a source presents itself as a pharmacy or telehealth service, verify it rather than taking the website's word. FDA's BeSafeRx resource says a likely safe online pharmacy “always requires a doctor's prescription,” “provides a physical address and telephone number in the United States,” “has a licensed pharmacist on staff to answer your questions” and “is licensed with a state board of pharmacy.” FDA's state license lookup points to each state board's database and adds: “If your online pharmacy is not listed, you should not use that pharmacy.”

A source that cannot pass those four checks is not a pharmacy, whatever its name says.

The Peptide Source Checklist

Use this as a scorecard. A single missing item is a question to ask; several missing items are a decision.

• Identity of the lab. The COA should name the testing laboratory, with an address and a report or sample number you could quote back to that lab. An unnamed lab is the same as no lab.
• Batch and lot match. The lot number on the COA must match the lot number printed on the vial you received. A COA for a different lot describes a different product.
• Purity by HPLC. High-performance liquid chromatography separates the main peptide from related impurities and reports a percentage. Look for the actual chromatogram, the method, and the specification the batch was tested against, not just a headline number.
• Identity by mass spectrometry. Purity measures how much of the sample is one substance; it does not prove which substance. A mass spectrometry result confirming the expected molecular mass is what establishes identity. Purity without identity is an incomplete COA.
• Endotoxin and sterility testing. Anything intended for injection carries two risks a purity test never addresses: bacterial endotoxins, which can cause fever and worse, and microbial contamination. A COA for injectable use should show both results. A COA for dry powder usually does not, and that is a meaningful gap.
• Testing date. The date on the COA should be recent and should sit before the product shipped, not after. Years-old dates on a “current batch” are a red flag the COA reading guide covers in detail.
• Independent third-party lab vs in-house. In-house testing is the seller grading its own homework. An independent laboratory with its own accountability is the stronger signal, though an independent name is still only a signal until you confirm it.
• Verify the COA with the lab directly. Contact the named laboratory with the report number and ask whether it issued that report for that lot. Legitimate labs answer that question. A seller who objects to you asking is telling you something.
• Consistent packaging and labeling. Vial labels, outer packaging, lot numbers and the compound name should agree with each other and with the COA. Mismatched names, missing lot numbers or hand-applied labels undermine every document above.
• Accountability. A physical address, a named business entity, a working phone line and a clear complaint path. Anonymity is cheap for a seller and expensive for a buyer.

The COA reading guide walks through one document line by line: lot numbers, purity limits, identity testing and the common marketing-page tricks. Use that guide to read the paper. Use this page to decide whether the paper, and the source behind it, deserves any trust at all.

What a COA Cannot Tell You