I discovered there's this weird HTTP thing called a preflight where the browser pings your URL with an OPTIONS request and expects you to return the headers with a 2xx status
Switch back to Netlify Cloud Functions (Firebase cloud functions don't allow outbound requests on the free plan and I found there is a way to have dependencies)