Tap the vial,
see the lab.

There are two ways to attach a batch's certificate: Res Labs can attach it before shipping, or you can attach it yourself after delivery. The buyer's experience is identical either way.

How did you choose to attach your certificate?

Pick one to see the matching step-by-step guide. You can switch any time.

Ownership binding is always done by res labs, before shipping. these two paths differ only in who attaches the lab certificate. you never bind tags yourself.

Same on both paths These five things never change, whichever path you pick

a lab certificate exists for the batch, and a link from the lab is preferred.
res labs ownership-binds every tag to its batch and ships. you never do this step.
you apply one sticker per vial, on the glass, under or beside your label, not over the metal cap.
an optional bench qa tap lets you confirm vials ("n of m confirmed"), for qa evidence only, never a buyer gate.
buyer verification is one identical backend check, no matter who attached the certificate.

Pre-delivery: Res Labs sets up my certificate

Res Labs attaches the certificate before your batch ships, so your tags arrive fully verifiable. Here is the flow end to end.

Before you start

your organization is onboarded and active, you're signed in, and your lab certificate already exists.

choose pre-assigned at order timeon the order screen, choose "pre-assigned before delivery" instead of the default.
provide or confirm the lab certificateshare the certificate (a link from the lab is preferred) so res labs can attach it before shipping.
res labs does thisres labs binds and attaches, then shipsres labs ownership-binds the batch and attaches the certificate before the chips leave the warehouse. shown here only for context, you don't do it.
receive your shipmenttake delivery and mark it received in the app.
apply one sticker per vialone chip per vial, on the glass, under or beside your label, not over the metal cap.
optional · qawalk the bench and confirm vialstap vials to confirm application ("n of m confirmed"). this is qa evidence only and never affects a buyer's tap.

Outcome

the batch is buyer-live from day one. the first buyer tap shows the certificate.

Post-delivery: I'll add my certificate myself

Your batch ships unassigned. After delivery you register the certificate and scan one sticker to make the whole batch live. This is the default order flow.

Before you start

your organization is onboarded and active, and you're signed in. the certificate doesn't need to exist yet when you order.

keep the default at order timeleave "ship unassigned, attach COAs later" selected. you can buy chips up front; extras simply sit as spare inventory.
res labs does thisres labs binds and ships unassignedres labs ownership-binds the batch and ships it unassigned (bound, no certificate yet). shown for context only.
receive your shipmenttake delivery and mark it received in the app.
register the lab certificateadd the certificate in the app with its declared quantity. a link from the lab is preferred; a pdf can ride along as optional evidence.
scan one genuine stickerscan a single sticker from the batch. the certificate fans out to every sticker and the batch goes live. the screen shows "certificate assigned to n stickers."
apply one sticker per vialsame placement guidance as above. application and self-assign can happen in either order.
optional · qabench qa confirm tapsame as path a, qa evidence only, never a buyer gate.

Why an attach can be blocked: the server enforces all of this

you're scoped to your own account: you can't touch another vendor's batch, and read-only / view-as sessions can't write.
the scan is a fresh genuine tap. a copied or reused tap is rejected as a replay, and scanning twice won't double-assign.
the quantities match: certificate declared = batch size = bound chips.
no other certificate is already attached to the batch.
the sticker is from a shipped or delivered shipment, on a batch that isn't recalled.

Until you self-assign

a buyer who taps sees "authentic tag, certificate pending." the chip is proven genuine; there's just no certificate to show yet. it clears the moment you self-assign.

Outcome

the batch is buyer-live. the very next tap shows the full verified page.

What a verified tap proves

The cryptography covers the chip, not the human handling it. The two-paths design doesn't widen this boundary.

It proves

the tag is genuine, holding the expected secret key.
the response is fresh, not a replay.

It does not prove

the sticker is on the correct vial.
the certificate matches the contents.

Those last two are handled by the process (separate labelled packs, certificate-to-batch matching, quantity limits, and tamper-evident labels), not by cryptography.

Glossary

certificate / coa: certificate of analysis: the lab's test result for a batch, hosted at a lab url.
uid: the chip's unique serial number.
ownership binding: res labs tying each chip's uid to a chip record and a batch, in the backend, before shipping. always central; vendors never do it.
certificate attachment: tying a batch to its lab certificate. res labs does it before shipping (path a) or you do it after delivery by scanning one sticker (path b).
unassigned / certificate pending: a batch that is bound and shipped but has no certificate yet; buyer taps show an authentic-but-pending page until a certificate is attached.
declared quantity: the batch size. a certificate only attaches when its declared quantity equals the batch size equals the count of bound chips.
qa confirm tap: an optional bench tap you do to record that vials were checked. never gates a buyer's verification, and not the same as attaching a certificate.
substitution: swapping a damaged chip for a fresh one within a batch. operator-only; vendors have no path to it.

Three things stay with Res Labs operators

ownership binding: tying tags to a batch, on both paths.
substitution: swapping a damaged chip for a fresh one within a batch.
recalls: vendors have no path to any of these.

if you need a damaged chip swapped, contact res labs.