Overview
The PeptideCheck API gives programs the compound reference data and the verified COA records that this site shows. It is read-only. Every endpoint answers GET with JSON and never changes data.
Research use only. Not for human or veterinary use. Not for diagnostic or therapeutic use. The API returns laboratory reference data. It carries no guidance on using a compound in people or animals.
Base URL:
https://peptideprotocolcheck.com/wp-json/pepcheck/api/v1
Building an AI agent? A plain-text description of this API for agents is at /.well-known/pepcheck-skill.md.
Get an API key
Keys are issued by hand. There is no sign-up form. Send a short request that says who you are, what you are building and, if a web page will call the API from a browser, the page origin (for example https://example.org).
To request a key: email info@peptideprotocolcheck.com.
Each key has a label and a contact email on file. A key can be revoked at any time, for example after misuse or if it is posted publicly. Keep keys out of public code and browser scripts you do not control.
Authentication
Send the key in the X-PepCheck-Key request header. Keys look like pck_ followed by 40 lowercase hexadecimal characters.
curl -H "X-PepCheck-Key: YOUR_KEY" \
"https://peptideprotocolcheck.com/wp-json/pepcheck/api/v1/compounds?per_page=5"
The key is not accepted in the query string, because URLs end up in server logs, browser history and Referer headers. A missing, malformed, unknown or revoked key gets status 401.
Only a keyed hash of each key is stored on the server, so a lost key cannot be looked up. Ask for a new one.
Rate limits and caching
The free tier allows 60 requests per minute per key. Past that, the API answers 429 with a Retry-After header (seconds until the window resets). Wait that long, then continue. Repeated requests with a bad key are also limited.
- Responses carry Cache-Control: public, max-age=300 and an ETag. Send If-None-Match with the ETag you hold and an unchanged answer is 304 with no body.
- Data is refreshed on a schedule, not live. Caching for five minutes or more costs you nothing.
- Page size is at most 50 (per_page). Use page to move through a list.
- Every key has the same limit today. Ask if you need more.
Browser use (CORS)
Server-side programs need nothing. A web page that calls the API from the visitor’s browser needs its origin on the CORS allow-list. Only listed origins receive an Access-Control-Allow-Origin header; any other origin is blocked by the browser. Include your origin when you request a key.
A browser page exposes its script to every visitor, so a key used there is public. Prefer calling the API from your own server and serving the answer to your pages.
GET /compounds
Compound reference data.
- category (optional): compound category slug.
- page and per_page (optional).
Each item has id, slug, name, url, categories, aliases, cas, molecular_weight, formula, sequence, vial_sizes_mg, storage_lyophilized, storage_reconstituted_days, half_life_hours and half_life_source_url. Empty text is an empty string and an unknown number is null.
Example (real record, October 17, 2026; shown trimmed to one item, the answer also has total and pages):
{
"items": [
{
"id": 9,
"slug": "bpc-157",
"name": "BPC-157",
"url": "https://peptideprotocolcheck.com/peptides/bpc-157/",
"categories": [
"Tissue biology research"
],
"aliases": [
"Body Protection Compound-157",
"Pentadecapeptide BPC 157",
"PL-14736",
"Bepecin"
],
"cas": "137525-51-0",
"molecular_weight": 1419.5,
"formula": "",
"sequence": "GEPPPGKPADDAGLV",
"vial_sizes_mg": [
5,
10
],
"storage_lyophilized": "",
"storage_reconstituted_days": null,
"half_life_hours": null,
"half_life_source_url": null
}
]
}
GET /coa
Verified certificate of analysis records only. A record appears here after a person on the PeptideCheck team has compared the report with its lot and compound. Unverified submissions are never returned.
- compound (optional): compound slug.
- page and per_page (optional).
Each item has id, vendor_slug, vendor_name (the supplier of the batch), compound_slug, compound_name, lab_slug, lab_name, lot_number, report_id, purity_pct, test_date, report_url and verified_at. The list can be empty; an unknown compound slug is a 404.
Example (shape only; every value below is a placeholder, not a real record):
{
"items": [
{
"id": 0,
"vendor_slug": "example-supplier",
"vendor_name": "Example Supplier",
"compound_slug": "example-compound",
"compound_name": "Example Compound",
"lab_slug": "example-lab",
"lab_name": "Example Lab",
"lot_number": "EXAMPLE-LOT",
"report_id": "EXAMPLE-REPORT",
"purity_pct": null,
"test_date": "2000-01-01",
"report_url": "https://example.org/report",
"verified_at": "2000-01-01T00:00:00Z"
}
],
"total": 1,
"pages": 1
}
Errors
Errors are JSON: {"code": "...", "message": "...", "data": {"status": 401}}.
- 400: a parameter is invalid. The message names it. Fix the request instead of retrying it.
- 401: the key is missing, malformed, unknown or revoked.
- 404: unknown compound slug.
- 429: rate limit reached. Wait for the Retry-After seconds.
Example (a request with no key):
{
"code": "pepcheck_api_unauthorized",
"message": "A valid API key is required. Send it in the X-PepCheck-Key header.",
"data": {
"status": 401
}
}
Attribution
When you republish or quote this data, please credit “PeptideCheck (peptideprotocolcheck.com)” and link to peptideprotocolcheck.com. Keep the research-use-only notice with any list you publish.
Every response includes a meta object with the source, this attribution request and the notice text.
What the API does not include
- Supplier product page addresses and affiliate parameters.
- Prices. The vendor and price endpoints were retired.
- Study references and calculator pages.
- Anything that is not listed in the endpoint sections above.
