Ask a compounding pharmacy for proof of what’s in the vial and you’ll receive a Certificate of Analysis — a dense lab report most patients file unread. Read, it answers the only questions that matter: is this the drug, at the strength, sterile enough to inject. This file is the field-by-field translation, and the honest limits.
What a CoA is — and which lab wrote it
A CoA reports test results for a specific lot: of the raw active ingredient (API), the finished compounded product, or both — and the distinction matters. An API certificate from the bulk supplier says the powder was right before compounding; a finished-product CoA from testing after compounding speaks to what’s actually in your vial. Independent third-party testing outranks in-house attestation. The first thing to locate is therefore the letterhead and scope: who tested, and tested what, exactly.
Lot number: the handshake
The CoA must name a lot, and that lot must match the one printed on your vial — character for character. A certificate that matches nothing you hold is marketing, not verification. This single cross-check defeats the laziest tier of paperwork theater, and skipping it makes every other field irrelevant.
Potency and assay: is it the drug, at the strength
Identity testing confirms the molecule is what the label claims; assay reports measured strength against labeled strength, typically as a percentage. Pharmacopeial practice generally accepts a band around 90–110% of label for compounded preparations — a vial assaying far outside that band is a mis-dose waiting for the syringe math to find it. Watch also for which form was quantified: salt-form games (counting the weight of a different chemical form to inflate apparent content) have been flagged repeatedly in this market’s enforcement letters. Legitimate reports name the tested form plainly.
Sterility, endotoxin, and the injectable-specific tests
For anything injected, three fields are non-negotiable: sterility (no microbial growth), bacterial endotoxin (pyrogens that cause fever and worse, reported against a limit), and, for multi-use vials, preservative effectiveness. Particulates and pH round out the finished-product picture. A “CoA” for an injectable that reports potency but is silent on sterility and endotoxin is a raw-powder certificate wearing a costume — exactly the pattern the gray-market file documents on research-chemical sites.
Dates: tested when, good until
Match the test date to the lot’s production window — a certificate predating the product it claims to describe is nonsense — and find the beyond-use date (BUD), the compounding world’s conservative cousin of expiration. Compounded sterile preparations carry short BUDs by rule; a vendor promising year-long life on a compounded vial is advertising a violation as a feature.
503A vs 503B: what testing is even required
Context changes expectations. 503B outsourcing facilities operate under manufacturing-grade rules with batch testing obligations — robust finished-product CoAs are the norm. 503A pharmacies compound per-prescription under pharmacy rules; testing every preparation isn’t required, so documentation there often means API certificates plus process credentials rather than per-vial assays. That asymmetry is one honest reason sourcing category matters — and why “which facility type, and can I see this lot’s CoA” belongs in the eight questions.
The red-flag checklist
Treat these as disqualifying until explained: no lot number, or lot mismatch with your vial; potency far outside the accepted band, or “99.9% purity” language with no assay-versus-label figure (purity of a powder is not strength of a solution); missing sterility/endotoxin on an injectable; no testing lab identified, or an in-house-only attestation for claims that warrant independence; “research use only” anywhere on product or paperwork — that phrase is a legal category, not a quality tier; and refusal to provide the document at all. One caveat cuts the other way: a beautiful CoA can be forged, which is why paper never substitutes for the licensure-and-prescription verification layers — it’s one instrument in the panel, not the panel.
The bottom line
Match the lot, read assay-versus-label, demand sterility and endotoxin for anything injectable, check the dates, and calibrate expectations to the facility type. Then remember what a document can’t do: paperwork verifies claims, licensure verifies accountability, and only the two together verify a pharmacy. Anything that fails this page fails the checklist — and anything “research grade” fails before the paperwork begins.
A worked read-through
A reader sends a two-page PDF from her telehealth pharmacy. Page one: third-party lab letterhead, finished-product scope, lot K-2417 — matching her vial. Assay: semaglutide 102.3% of label, form named. Sterility: no growth; endotoxin: below limit with the limit stated; pH and particulates within range; BUD sixty days out, test date three weeks prior. Page two: API supplier certificate for the same lot’s input powder. Verdict: as good as compounded paperwork gets — proceed to the licensure checks. Contrast the forum specimen the same week: one page, no lot, “purity 99%,” no sterility line, “for research purposes” in the footer. Verdict: not a pharmacy document at all — the gray-market file’s jurisdiction, and a hard stop.
Mini-FAQ
Should I request the CoA before ordering? Yes — the request itself is diagnostic; legitimate operations answer it routinely. Per-lot or per-batch? Ask for the lot you’ll receive; “representative” certificates are weaker but normal from 503A settings — weigh accordingly. Can I get a vial independently tested? Services exist, mostly serving clinics; for a patient it’s costly and slow, which is why upstream sourcing diligence dominates downstream chemistry. Does a clean CoA make gray-market product okay? No — sterility and legality are separate axes, and injecting research chemicals fails the second regardless of the first. What single line matters most? The lot match — without it, you’re reading a document about someone else’s vial.
The vocabulary, decoded
Five terms carry most of the document. Identity: the molecule is what’s claimed — pass/fail. Assay (potency): how much of it, measured against label — the percentage that should live near 100. Purity: what fraction of the powder is the compound versus impurities — note that “99% pure” says nothing about whether your 1 mL contains 2.5 mg; purity describes powder, potency describes product, and conflating them is the gray market’s favorite sleight. Endotoxin: bacterial fragments that survive sterilization and cause fever reactions — reported in endotoxin units against a stated limit; the limit’s presence matters as much as the number. Sterility: growth-based testing over days, which is why real sterility results can’t predate a batch by hours. Beyond-use date versus expiration: BUD is the compounding-specific, deliberately shorter window — an artifact of making medicine outside industrial controls, and a number that honest vendors treat conservatively.
What testing costs — and what that implies about price
Per-lot finished-product testing — assay, sterility, endotoxin at an independent lab — costs real money per batch, and that cost lands in the price of every vial. Hold that against the market’s cheapest offers: rock-bottom pricing and rigorous per-lot verification rarely share a business model, which is one more reason impossible prices predict corners cut somewhere you can’t see. The email that surfaces all of this in one pass: “Before ordering — is product compounded at a 503A pharmacy or 503B facility; is finished-product testing per lot or representative; may I see the CoA for the lot I’d receive, and will its number match my vial?” Four clauses, two minutes, and the answer — including the tone of the answer — completes half of the checklist before money moves.
Special cases the template misses
Three variants deserve their own scrutiny. Oral and dissolvable compounded formats: everything this file says about assay applies, sterility pressure relaxes (nothing’s injected), but a new question appears — whether anyone tested that the format delivers the drug at all, the evidence gap the ODT file documents; a clean CoA cannot answer a bioavailability question. Microdose vials: identical rules, higher stakes per milliliter — small labeled strengths make percentage errors proportionally larger in syringe math, so the microdosing file’s caution and this file’s lot-match habit compound. And refills: concentration and formulation can shift between batches at the same pharmacy, which is why the CoA request is a per-lot ritual, not a one-time diligence box — the same discipline as the recompute-every-refill rule, applied one document upstream.
Reduce it to the two-document rule: before any compounded vial touches a syringe, you hold the CoA whose lot matches the label, and the pharmacy’s license verifies at the state board. Paper plus licensure — chemistry and accountability. One without the other is half a verification; neither is a vial you inject on faith.
Print this file’s red-flag list; staple it to the next PDF a pharmacy sends. Ten minutes of reading is the cheapest test in this entire market.
Sources
USP compounding chapters on sterile preparations and BUDs; FDA guidance distinguishing 503A/503B obligations; FDA and state-board communications on compounded GLP-1 potency and salt-form issues. Primary links at sources.