403 for OPTIONS request through Cloudflare

We are seeing 403 responses on the OPTIONS request only when it is routed via Cloudflare.

Is OPTIONS method allowed by default? What could be causing the 403s on OPTIONS request?

OPTIONS is recognized by Cloudflare (It’s listed in Firewall Rules as a valid request method).

Check the Firewall Events Log to see if those requests are triggering a block rule.