How to verify a peptide certificate of analysis
A certificate you were handed is a copy. The only thing that establishes what a laboratory actually reported is that laboratory's own record, and the single most useful habit in this market is resolving the report identifier yourself instead of trusting the document in front of you.
The checklist below works on a certificate from any laboratory. The second half covers what is specific to an Axiom certificate, including how to verify one offline, against published keys, without trusting this website at all.
Seven checks that work on any COA
In rough order of how much each one can invalidate. None of these requires a laboratory, an account, or any tooling beyond a browser.
- 01
Resolve the report at the laboratory, not at the seller
WHYA certificate you were handed is a copy. The only thing that establishes what the laboratory actually reported is the laboratory's own record. Every other property of the document, including a QR code, is only as good as where it resolves.
HOWFind the report ID and look it up on the issuing laboratory's own domain. If there is a QR code, check where it points before you scan it, and confirm the domain belongs to the lab rather than to the vendor. A lookup form on the lab's site, a per-report URL, or a documented API call all work.
If this check failsIf the report ID does not resolve at the laboratory, you do not have a verified certificate. That is not proof of forgery on its own, since some labs only release records to the submitting customer, but it does mean the document in your hand is unconfirmed and you should ask the seller to have the lab confirm it.
- 02
Compare the copy you were given against the record you retrieved
WHYThe failure mode here is not a fabricated certificate. It is a real certificate with one field changed: a purity figure, a lot number, a date, a label claim.
HOWRead the retrieved record side by side with your copy and check the fields that carry the money: compound, lot or batch, label claim, every reported result, and the release date. Check the version too, if the lab publishes one.
If this check failsAny field that differs makes the copy unreliable in full. Do not try to reconcile which version is right; use the laboratory's record and ask the seller where the other document came from.
- 03
Check the certificate is still current
WHYA certificate is a statement made on a date. It can be amended, superseded by a new version, or withdrawn afterwards, and none of those events change the piece of paper already in circulation.
HOWLook for a version number and a status. A well-run lab distinguishes two separate questions: is the document authentic, and is it still standing. A withdrawn certificate is still authentically issued; it just no longer represents the lab's position.
If this check failsIf the record shows the certificate has been superseded, use the current version. If it shows it was withdrawn, the reported results no longer stand, and the reason should be available to you.
- 04
Read the method beside every result
WHYA number without a method cannot be interpreted, and two methods answering the same question can differ in strength by a wide margin. Identity by accurate mass and identity by retention-time matching are not the same evidence. A rapid microbial screen and a compendial sterility test are not the same test.
HOWFor each reported result, find the instrument or compendial reference that produced it, and the acceptance criterion it was scored against. Then ask whether that method can see the thing being claimed.
If this check failsA certificate that reports results without naming the method for each is not interpretable, however good the numbers look. Ask the laboratory for the method statement before treating the numbers as meaningful.
- 05
Check identity component by component
WHYOn a multi-component blend, the identity question is asked once per declared component. It is entirely possible for a certificate to confirm one component and be silent on the others while still printing a single pass.
HOWFor a single compound, look for a theoretical mass, an observed mass, and an error, ideally in ppm as well as daltons. For a blend, confirm that every declared component has all three. A component with no theoretical mass on file has not been confirmed either, however the row is styled.
If this check failsAn identity pass supported by fewer components than the label declares is a narrower claim than it appears. Ask which components were resolved.
- 06
Read purity and content as two separate questions
WHYPurity is a proportion of what the detector could see. Content is a quantity in milligrams. A vial can be extremely pure and substantially under-dosed, and a purity figure alone will never reveal it.
HOWFind both numbers. If the certificate reports only a purity percentage, you know how clean the material is relative to what the detector saw and you do not know the dose. If it reports content, check it against the label claim and look at the variance in both directions.
If this check failsA certificate carrying purity but no content is not wrong, it is incomplete for the question most buyers are actually asking. Order or request the content determination separately.
- 07
Check what the certificate says about the sample it describes
WHYThe strongest analysis in the world is worthless if it describes a different vial. Physical form, lot, and label claim are the fields that tie the document to the object in your hand.
HOWConfirm the compound, the lot or batch, the label claim, and the physical form all match the vial you received. Check how many vials were tested: a lot-level conclusion drawn from one vial is a statement about one vial.
If this check failsA mismatch between the certificate and the vial is a stop condition, not a rounding error. A liquid certified as a lyophilised powder means the document is describing something else.
Document-level red flags
Each of these is a property of a document, not of a company. None of them proves bad faith on its own. What they have in common is that they make a certificate impossible to check, which is a problem regardless of who issued it.
A screenshot or JPEG on a product page cannot be resolved back to the laboratory. It is a picture of a claim rather than the claim itself.
Without an ID that the issuing lab recognises, nothing about the document can be confirmed by anyone other than the person who handed it to you.
A certificate with no lot cannot be tied to the vial you received. It may be a genuine result for a batch you did not buy.
A percentage with no wavelength, no compendial reference and no limit cannot be interpreted. It also cannot be wrong, which is the problem.
Chromatographic purity is an area ratio measured against a real baseline with real integration limits. Reporting it as a clean 100.0% usually means rounding or a truncated denominator rather than a perfect sample.
Identity is a comparison against something. If the certificate does not say what the sample was compared against, no comparison has been reported.
Sterility and endotoxin are different questions answered by different compendial procedures on very different timescales. A single word like sterile, with nothing behind it, tells you which one was run: neither.
Certificates are per-lot. A certificate for an older lot says nothing about the current one, however good it is.
Accreditation always applies to a defined scope of tests, and an accrediting body publishes the certificate and that scope. A logo alone does not tell you whether the test on your certificate is inside the scope.
Verifying an Axiom certificate
There are four routes, in increasing order of independence from us. Every one of them resolves against the laboratory record rather than against a file somebody sent you.
Scan the QR, or enter the report ID
The QR on an Axiom certificate points at axiomanalyticslab.com, not at the vendor who sold you the vial. That is the property that makes it worth scanning. You can also type the report ID straight into the verification page.
GO TO /verifyRead the record at its own URL
Every released certificate lives at a public URL that renders the laboratory record itself, including the per-layer results, the charts, the vial photograph and the signing block. It is not a PDF that has to be passed around.
EXAMPLE: /coa/AX-DEMO-4XCall the public endpoint
One unauthenticated request returns the record, its state, and the full signing block. This is the route to automate if you are a vendor syncing certificates onto product pages, or a buyer checking a batch of them.
curl https://axiomanalyticslab.com/api/coa/AX-DEMO-4X
Verify the seal yourself, offline
The strongest route, and the one that does not require trusting us. Reproduce the digest from the published canonical bytes and check the signature against public keys you already hold. Detailed below.
JUMP TO OFFLINE VERIFICATIONVerifying without trusting this website
A verification page that says VALID is only as trustworthy as the server rendering it. That is a real limitation of every lookup-based verification system, ours included, and the fix is to publish enough that a third party can check the document without asking us anything.
So the recipe is published rather than described. Every Axiom certificate is signed with EdDSA over a SHA-384 digest of a canonical payload, under the spec version axiom-coa-sig-v1. Three static documents make it reproducible.
| Document | What it gives you |
|---|---|
| /.well-known/jwks.json | The public keys, as a standard JWKS. Match a signature to a key by its key id. Fetch once and keep them. |
| /.well-known/axiom-coa-signing.json | The exact canonicalisation and digest recipe: which fields are covered, how they are sorted, and what bytes are signed. |
| /.well-known/axiom-coa-testvector.json | A self-contained test vector, so you can prove your implementation is correct before you point it at a real certificate. |
import { createHash, createPublicKey, verify } from "node:crypto";
const r = await (await fetch("https://axiomanalyticslab.com/api/coa/AX-DEMO-4X")).json();
const jwks = await (await fetch("https://axiomanalyticslab.com/.well-known/jwks.json")).json();
const s = r.signing;
// 1. reproduce the digest from the exact published canonical bytes
const sha = createHash("sha384").update(Buffer.from(s.canonicalPayload, "utf8")).digest("hex");
console.log("digest reproduced:", sha === s.sha384);
// 2. verify every signature against its JWKS key, matched by kid
for (const sig of s.signatures) {
const jwk = jwks.keys.find((k) => k.kid === sig.kid);
const pub = createPublicKey({ key: jwk, format: "jwk" });
const ok = verify(null, Buffer.from(s.sha384, "hex"), pub, Buffer.from(sig.signature.slice(8), "hex"));
console.log(sig.role, ok ? "VERIFIED" : "FAILED");
}
// 3. authenticity and standing are SEPARATE answers
console.log("verified =", r.verified, "| state =", r.state);Once you hold the keys, steps 1 and 2 need no network access at all. A certificate you archived today stays verifiable against keys you archived today, which is the property that matters if this laboratory ever stopped answering. Full integrator documentation, including webhooks and the sandbox certificates, is on the developer guide.
Authentic and current are two different questions
This trips up most verification implementations, including ones written against our own API, so it is worth stating plainly: a signature proves a document was issued by whoever holds the key and has not been altered since. It says nothing about whether the laboratory still stands behind it.
A certificate can be amended, superseded by a later version, or withdrawn outright, and none of those events changes the copy already in circulation. A withdrawn certificate is still authentically signed. Our endpoint therefore reports the two separately: the signature block carries authenticity, and state carries standing.
Signed, unaltered, and still the laboratory's current position on that lot.
Corrected by a later version. The original is retained and still verifies; the newer version is the one to read. An amendment records the reason and the change.
Withdrawn. The signature is still authentic, and the reported results no longer stand. A revoked certificate stops being served as a PDF, and the reason is published with it.
If you are building against this, point your code at the revoked sandbox certificate and confirm your user interface downgrades rather than showing a green tick because the signature checked out. That is the bug this endpoint shape exists to make impossible to miss.
curl https://axiomanalyticslab.com/api/coa/AX-DEMO-REVOKED
# -> { "verified": false, "state": "revoked", "signature": { "authentic": true }, ... }Every released Axiom certificate is verifiable by anyone holding its report ID, on this domain, with no account.