Why does the browser send an OPTIONS request before some of our API calls, and how do you stop it failing?

That OPTIONS call is the CORS preflight. Browsers send it whenever a cross origin request is not simple, which covers any custom header, a JSON content type, or a method other than GET, HEAD or POST. Your server has to answer that OPTIONS with Access-Control-Allow-Origin, Allow-Methods and Allow-Headers that actually cover the real request, plus Allow-Credentials and a concrete origin if cookies are involved.

The preflight is the browser asking permission before it sends anything with side effects. A plain GET with no custom headers is a simple request and goes straight out, but the moment you add an Authorization header or send application/json, you get the OPTIONS first. When it fails, I check three things in order: does the server answer OPTIONS at all, does Access-Control-Allow-Headers list every header the real request sends, and is the origin echoed exactly including scheme and port. The credentials case catches people out, because if you send cookies you cannot use a wildcard origin; you have to reflect a specific allowed origin and set Access-Control-Allow-Credentials to true. I also set Access-Control-Max-Age so the browser stops preflighting every single call. The thing I make sure a team understands is that none of this protects the API. Anything that is not a browser ignores CORS entirely, so authorization still has to be enforced on the server.