How to Read a Compounded GLP-1 COA

How can you check a compounded GLP-1 COA in 60 seconds?

Three questions, answered in order, will tell you more than any number on the page. Identify what material was tested, whether the document traces to your vial, and who manufactured the raw ingredient. Results are only meaningful once you know what sample they describe.

Do not skip to the percentages. That’s the mistake.

Plenty of guides send you straight to “look for 99% purity.” That’s backwards. A purity result you can’t trace to your vial, from a manufacturer you can’t name, is a number on a PDF.

The two documents, side by side

What does a compounded GLP-1 COA actually prove?

A certificate of analysis summarizes specified tests and results for identified material. It may be issued by a manufacturer’s quality unit, a pharmacy, or a testing laboratory, so the first things to identify are who issued it, what was tested, and which lot it covers. It does not make a compounded drug FDA-approved.

Think of a COA like a receipt. It’s proof that something specific happened — certain tests, on identified material, on a date. It is not proof of everything that happened before or after. Note that “third-party tested” is doing less work than it sounds like. A COA is not automatically an independent laboratory report. Check who issued it.

Five conclusions people reach that a COA can’t support on its own:

The Evidence Ladder

A recurring source of confusion is receiving a generic or API-level document and reading it as finished-batch evidence. That gap — between what a document appears to promise and what it actually covers — is what this page exists to close.

Is your COA for the raw ingredient or your finished vial?

Classify the document before you read any result. Federal law requires qualifying bulk drug substances used in compounding under sections 503A and 503B to be accompanied by a valid certificate of analysis, so a pharmacy may genuinely hold and share a COA that covers only the raw powder. A separate finished-product report is what speaks to the batch that became your vial.

This is why so many people end up confused. The pharmacy usually isn’t hiding anything. They gave you a real document that satisfies a real legal requirement. It just answers a different question than the one you’re asking.

Signs the document covers raw API

Several of these together strongly suggest raw-material testing — but classify it only after you’ve confirmed what the test article or sample description says:

• The words "active pharmaceutical ingredient," "bulk drug substance," or "raw material"
• A CAS number (a chemical registry number) or a molecular formula
• Appearance described as a powder — "white to off-white lyophilized powder"
• A manufacturing date and a retest date rather than a beyond-use date
• Water content, residual solvents, heavy metals, or "related substances"
• Purity expressed as a chromatographic area percentage
• No mg/mL anywhere on the document
• No pharmacy name, no compounding batch, no vial lot

Signs it covers your finished product

• The full formulation name and dosage form — "semaglutide injection," "compounded oral solution"
• A concentration in mg/mL or mg per unit
• The compounding pharmacy or outsourcing facility named
• A compounded-on date and a beyond-use date (BUD)
• Potency or assay stated against the labeled strength
• For an injectable: sterility, bacterial endotoxin, and particulate matter results
• A quality review or release approval

It may not be called a “COA” at all

Finished-batch documentation appears under several names:

• Analytical report
• Certificate of testing
• Batch release report
• Quality control report
• Finished product testing report

A worked example

Here’s how one product generates two very different records. These values are illustrative, not real results.

Document A is genuinely useful. It says something real about the ingredient. But if your vial is labeled lot WLB-260412, only Document B is describing your medicine. If someone handed you Document A and told you it proves your vial is 99.4% pure — that isn’t what it says.

Does the COA lot number match your vial?

On a finished-product report, the batch or lot should trace to the lot printed on your vial or dispensing label. An API lot will usually be a different number, and that difference alone is not evidence of a problem. What matters is whether the pharmacy can document the connection between them.

The chain

Your identifier worksheet

Copy these into your notes app before you contact anyone. This two-minute step turns a confusing ten-minute call into a two-minute one.

Privacy note: keep your prescription number out of any online tool, including ours. You don’t need it for any of this.

The mini-check

You need three inputs, not two — two numbers alone can’t tell an API lot from a finished batch.

How do you read a compounded GLP-1 COA line by line?

Read a COA in this order: scope, tested material, drug, lot, concentration, dates, laboratory, method, specification, result, release. Every result means something only in relation to the specification printed beside it.

Most people read a COA the way they read a nutrition label — eyes straight to the big number. Resist that. The big number is the last thing that matters.

The 24-field decoder

We assembled this from FDA’s compounding requirements, USP’s sterile compounding framework, published API certificates, and finished-product reports providers have made public. Work through the groups in order.

The five-part reading pattern

For every row on a complete report, you should be able to fill in all five:

Illustrative example, not a universal product specification.

If a row is missing the method or the specification, “Pass” isn’t independently interpretable from the copy you’re holding. Pass compared to what?

How do you verify the API manufacturer on a compounded GLP-1 COA?

Under federal law, a bulk drug substance used in compounding must clear two separate conditions: it has to be accompanied by a valid certificate of analysis, and it has to be manufactured at an establishment registered with FDA. Registration status is publicly searchable in FDA’s Drug Establishments Current Registration Site. In the basis for its GLP-1 import alert, FDA reported evaluating 48 GLP-1 API sites and finding 21% noncompliant.

Why FDA cares about this specifically

In September 2025, FDA issued Import Alert 66-80, covering detention of GLP-1 bulk drug substances at the border:

• FDA evaluated 48 GLP-1 API sites through onsite inspections and remote records requests
• 21% were noncompliant — their records showed manufacturing-practice problems, or they didn't respond to FDA's request in time
• FDA described a pattern of sites that register as GLP-1 API manufacturers, offer ingredient for import, refuse FDA's requests for records, then deregister — all within a short window
• FDA noted the API was being supplied by manufacturers around the world, including China, India, and Europe
• FDA published a "green list" of facility-and-product entries that appeared compliant based on its inspections and evaluations

Roughly one in five of the GLP-1 ingredient sites FDA looked at didn’t hold up. That’s FDA’s own published reasoning for a border action.

How to check it — three steps

What a match actually proves

If you can’t find a name, don’t spiral. Ask: “What is the registered legal name of the establishment that manufactured the API, and is it FDA-registered?” FDA itself urges compounders to know their bulk suppliers, so this is a question a careful pharmacy is prepared for.

Why this is worth your time: a purity result is a claim printed on a document. A registration status is a narrow fact you can check yourself, in a federal database that neither you nor the seller controls.

What do identity, purity, potency, and assay actually mean?

Identity asks what the substance is. Purity asks what share of the tested material is the intended substance versus related material. Potency or assay asks how much is present compared to the labeled strength. These answer three different questions and none substitutes for another. A high purity result on raw powder tells you nothing about sterility, and neither tells you what’s in your vial.

Plain-English versions

• Identity — Is this the right molecule?
• Purity / related substances — What else is in the tested material?
• Potency / assay — How much is there, compared to what the label says?
• Sterility — Did the tested units show microbial growth?
• Bacterial endotoxins — Were fever-causing bacterial fragments below the limit?
• Particulate matter — Were there unintended particles?

The label-claim calculation

What range should you expect?

USP uses a ±10% strength-variation reference — 90.0% to 110.0% — for many compounded preparations where no different applicable monograph limit governs. That range is a genuinely useful reference point. Don’t treat it as a universal pass/fail rule for every GLP-1 report. The applicable specification depends on the formulation, whether a monograph applies, the validated method, and the pharmacy’s release criteria. The specification printed on your document governs your result.

Does 99% purity mean it’s safe or dosed right?

No. A 99% purity result typically describes one analytical attribute of one tested material, often raw powder. It does not establish your vial’s concentration, sterility, endotoxin level, storage history, or clinical suitability. In published testing of semaglutide bought from illegal no-prescription online sellers, products advertised at 99% purity measured between roughly 7% and 14% (JAMA Network Open, August 2024).

When 99% meant 7%

In a study published in JAMA Network Open in August 2024, researchers ordered semaglutide from six online sellers requiring no prescription. Three vendors never delivered anything — instead demanding an extra $650–$1,200 in fake “customs” fees. Of the three products that did arrive, testing found measured purity between about 7% and 14%, against advertised purity of 99%. One sample carried an elevated endotoxin level of 8.95 EU/mg.

Five different things people call “purity”

The bigger-number trap

99.8 is the bigger number. Document B is dramatically more useful. It’s about your medicine. Never rank documents by the size of the percentage.

Which tests matter for injections vs. pills and drops?

For a sterile injectable, incorrect strength, microbial contamination, bacterial endotoxins, and unintended particles are four separate failure modes. Oral, sublingual, and other nonsterile forms are evaluated against a different set of attributes, and the absence of a sterility result on an oral product is not a defect. We use the word applicable deliberately — there is no single universal test panel legally required for every 503A batch.

Sterility and endotoxin are not the same test

• Sterility testing looks for living microorganisms.
• Endotoxin testing looks for fragments of certain bacteria that can remain and cause fever or inflammation even when nothing living is found.

One doesn’t cover the other. In published research, samples showed no viable microorganisms — and still had detectable endotoxin.

What are the biggest compounded GLP-1 COA red flags?

Not every gap on a COA is an emergency, and treating them all the same leads people to either panic or ignore everything. Sorting findings into three tiers keeps the response proportional.

Ask about it — normal questions, not alarms

Pause and get an answer before continuing

Stop and contact a licensed professional before using it

FDA’s own telehealth warning signs

FDA flags companies that:

• Claim a compounded drug is the same as an FDA-approved drug
• Offer prices that seem too good to be true
• Ship medicine that looks different from what you received before, or arrives damaged
• Skip a licensed prescriber's screening
• Have no clinician available after you receive the medication
• Make spelling errors on the label
• List an incorrect pharmacy address
• Name a pharmacy you suspect is fraudulent

If multiple items on that list describe your provider or your shipment, verify the provider and the dispensing pharmacy before you rely on the document at all. The document isn’t the real question at that point.

Does a COA mean the compounded GLP-1 is FDA-approved or legal?

No. Compounded drugs are not FDA-approved, meaning FDA does not review them for safety, effectiveness, or quality before marketing. A certificate of analysis reports laboratory results; it does not establish that a prescription was valid, that every condition of section 503A or 503B was met, or that current policy permits what was compounded.

Two terms, defined once

• Section 503A covers qualifying compounding by licensed pharmacists in state-licensed pharmacies, generally for identified patients. Limited anticipatory compounding is allowed. All 503A conditions still apply, including restrictions on essentially copying a commercially available drug.
• A 503B outsourcing facility chooses to register with FDA, must comply with applicable current good manufacturing practice requirements, and is subject to risk-based FDA inspection. Registration is not approval. Never describe a 503B as “FDA-approved.”

Where things stand — verified July 18, 2026

What a COA can’t tell you about legality

• Whether a valid patient-specific prescription existed
• Whether an FDA-approved product could have met your needs
• Whether compounding and shipping met every federal and state condition
• Whether the marketing claims you saw were lawful

A flawless document from a pharmacy operating outside the rules is still a document from a pharmacy operating outside the rules. Paperwork and legality are separate questions.

One asymmetry worth knowing

Federal law does not require state-licensed pharmacies that are not outsourcing facilities to report adverse events to FDA. As of May 31, 2026, FDA reported receiving 990 adverse event reports associated with compounded semaglutide and more than 730 associated with compounded tirzepatide. These are report counts, not incidence rates. FDA notes it isn’t always possible to determine whether an event resulted from the drug, and that many reported events appear consistent with those seen with the FDA-approved versions. In the 503A world there’s less automatic reporting running in the background, which is part of why the questions you ask carry real weight.

How do you check the pharmacy, the lab, and the COA itself?

Verify the entities independently of the paperwork they gave you. The principle: never verify a document using only the contact information printed on that document. That’s circular. Find the number yourself.

Check the dispensing pharmacy

1. Copy the pharmacy's legal name and address from your label, not from the COA
2. Go to the board of pharmacy for that pharmacy's home state
3. Check license status and any recorded disciplinary history
4. Check whether it's licensed to ship into your state, where that applies
5. Call using a number from the official listing

FDA’s BeSafeRx resources are a reasonable starting point for confirming an online pharmacy is state-licensed.

Check a claimed 503B facility

FDA publishes its list of registered outsourcing facilities. Match the exact legal name and location — brand names and legal entity names often differ. A facility is registered, not certified, not approved. If a provider’s marketing says “FDA-approved 503B pharmacy,” that phrase is wrong — and it tells you something about how carefully they write.

Check the laboratory

Look for a real name, physical address, working phone number, official domain, report ID, and a named analyst or reviewer. If accreditation is claimed, verify both the laboratory and the specific scope of that accreditation — accreditation covers particular test types, not a whole company.

How can you tell whether a compounded GLP-1 COA is authentic?

You often can’t authenticate it yourself — but you can check whether it’s internally consistent and whether the issuing laboratory confirms it.What you can do is look for inconsistencies that warrant a question:

• Report ID appears consistently throughout
• Pages are numbered and complete ("Page 2 of 4" — and you have all four)
• Revision status is stated
• Lot numbers and dates agree with each other
• Signatures or electronic approvals are present
• Fonts, alignment, and spacing look consistent — a mismatched font around a number is worth a second look
• A QR code is convenience, not authentication. It proves someone printed a QR code. Follow it, then confirm the report ID and lot through information you found independently
• The most direct check: contact the laboratory through details you sourced yourself and ask whether they issued that report number

What should you ask your pharmacy? (copy and paste)

The most effective request names your vial’s lot number and forces the scope question directly: is this document about the raw ingredient or the finished product? That phrasing can’t be satisfied with a generic document.

We wrote these so you don’t have to. Copy, fill in your lot number, send.

What a useful answer sounds like

What if the COA is missing, generic, or doesn’t match?

A missing or unclear COA is a reason to ask questions, not a verdict that a product is unsafe or counterfeit. Preserve the vial, label, packaging, documents, and messages, then contact the dispensing pharmacist and your prescriber before relying on the document.

If no COA is provided at all

1. Ask whether they have an API COA, a finished-product report, or both
2. Ask what testing applied to your batch
3. Ask for a pharmacist's written explanation if the document itself can't be shared
4. Verify the pharmacy independently
5. Save the response

If the lot doesn’t seem to match

• Recheck whether one number is the API lot and another is the finished lot
• Ask about parent batches and derived fill lots
• Ask the pharmacist to map the identifiers in writing
• Don't conclude fraud from mismatched numbers alone

If it arrived warm or damaged

Follow the storage instructions on the approved labeling or your dispensing label. FDA recommends not using an injectable GLP-1 that arrives warm or with insufficient refrigeration. Photograph the package, the ice packs, and the vial. A perfect COA says nothing about what happened in a delivery truck.

If the concentration conflicts with your instructions

If you already used it

• An incomplete document is not evidence that you were harmed
• Preserve what you have
• Contact your prescriber or pharmacist and describe what you found
• Seek prompt medical care for severe or worsening symptoms
• Do not change your dose on your own based on anything on a COA — including this page

How do you compare two compounded GLP-1 COAs?

Compare like with like: API to API, finished product to finished product, same dosage form, compatible units, comparable methods. The document with more context is usually more useful than the document with the more impressive number.

Fill this in for both before deciding anything:

That last row is the one that matters. The better document isn’t the one with the best number — it’s the one that leaves the fewest questions open.

Three comparisons that produce garbage

• Ranking laboratories by one number. Methods, specifications, and sample types differ. You'd be comparing answers to different questions.
• Comparing a research-supplier COA to a pharmacy batch report. Different universes.
• Treating a bigger percentage as better. See above. Repeatedly.

Should you choose an FDA-approved GLP-1 instead?

Some readers finish this page and decide they don’t want to keep auditing paperwork. That’s a legitimate conclusion, not a failure. With FDA-approved medications, patients generally verify through the dispensing pharmacy, approved labeling, manufacturer and lot information, recalls, and FDA oversight — rather than by requesting a patient-facing COA.

If the paperwork question is what’s keeping you up at night, take that seriously — not because compounded medicine from a licensed pharmacy is inherently wrong, but because peace of mind is part of whether a treatment works for your life.

And if you work through the checks in this guide and everything holds up — clear document scope, a traceable lot, a named API manufacturer whose registration you checked, a pharmacy with an active license — those checks resolve real documentation and identity questions. They don’t establish medication safety, lawful compounding, or clinical suitability. But you’d have done real diligence, with your eyes open, and that is a legitimate place to stand.

What we verified, and what we didn’t

Verified July 18, 2026. Here’s our work.

Who made this, how, and why

Who: the Weight Loss Provider Guide editorial team. We’re an independent comparison resource for GLP-1 telehealth providers. We are not clinicians, pharmacists, or chemists, and we don’t claim to be.

How: we read FDA’s compounding guidance, the 503A and 503B statutes, USP’s compounding standards, FDA’s import alert and its basis, published peer-reviewed research, and publicly available COA examples — then checked every material claim against a primary source.

Why: patients routinely ask “how do I read a COA?” and routinely receive answers that conflate raw-material and finished-product documentation. We built this guide because that gap is both correctable and consequential. See our corrections policy if you spot an error.

Frequently asked questions

How can you check a compounded GLP-1 COA in 60 seconds?

Ask three questions in order: What material was tested — raw powder or finished medicine? Can you trace the lot to your vial? Who manufactured the raw ingredient, and is that establishment FDA-registered? Do not start with the purity percentage.

What does a compounded GLP-1 COA actually prove?

A COA summarizes specified tests and results for identified material. It does not make a compounded drug FDA-approved, establish that a prescription was valid, or guarantee every vial in the batch is sterile. Think of it as a receipt: proof that specific tests happened on identified material, on a date.

Is my COA for the raw ingredient or my finished vial?

If the document shows a powder appearance, CAS number, retest date, water content, and no mg/mL — it is a raw API record. If it shows mg/mL, a beyond-use date, a pharmacy name, and sterility results — it covers your finished product. Classify it before reading any numbers.

Does the COA lot number need to match my vial lot?

On a finished-product report, the lot should trace to your vial. An API lot will usually differ from your vial lot — that alone is not fraud. What matters is whether the pharmacy can document the chain from raw material to your vial in writing.

How do you verify the API manufacturer?

Step 1: Get the manufacturer's registered legal name from the document or ask the pharmacy. Step 2: Search FDA's Drug Establishments Current Registration Site (DECRS). Step 3: Cross-check FDA's Import Alert 66-80 green list. A match confirms only that the establishment appears in FDA's registration data — not quality, approval, or that they supplied your specific lot.

Does 99% purity mean the medication is safe or dosed right?

No. A 99% purity result typically describes one attribute of one tested material, often raw powder. In published testing of semaglutide from illegal no-prescription online sellers, products advertised at 99% purity measured between roughly 7% and 14% (JAMA Network Open, August 2024). Purity is worth exactly as much as your ability to verify who produced it.

Which tests matter for injectables versus pills?

For injectables, documentation should address finished-product potency or assay, sterility, bacterial endotoxins, particulate matter, and release approval — where each is applicable to that batch. For oral or sublingual products, the sterility test is not a sterile-product requirement. The applicable tests depend on the formulation and what the pharmacy's release criteria require.

What are the biggest red flags on a compounded GLP-1 COA?

"Research use only," a salt form (semaglutide sodium, semaglutide acetate), retatrutide, or cagrilintide anywhere on the document — stop and contact a licensed professional. Pause (don't panic) if there's no tested-material description, no specification or method, or a generic document. Different lot numbers alone are not a red flag.

Does a COA mean the compounded GLP-1 is FDA-approved?

No. Compounded drugs are not FDA-approved. A COA reports laboratory results; it does not establish that a prescription was valid or that every condition of section 503A or 503B was met.

What should I ask my pharmacy about the COA?

Ask: whether the document covers the raw API or the finished product, how the lot maps to your vial lot in writing, the registered legal name of the API manufacturer, and for injectables — which sterility, endotoxin, and particulate tests applied to your batch. Request a pharmacist's written explanation if the full report can't be shared.

What should I do if my COA is missing, generic, or the lot doesn't match?

A missing or unclear COA is a reason to ask questions, not a verdict about safety. Preserve the vial, label, packaging, and all documents. Contact the dispensing pharmacist and your prescriber. For a warm shipment or a concentration that conflicts with your instructions, follow FDA's guidance and contact your prescriber before using the medication.

How do you compare two compounded GLP-1 COAs?

Compare like with like: API to API, finished product to finished product. The document with more context is more useful than the document with the bigger number. A 99.8% API purity result is less useful than a 97% finished-product assay that traces to your vial lot with sterility results included.