Platforms don't refetch a page's og:image every time someone shares the link. They cache whatever their crawler bot saw the first time your page was posted. If you update the image later, anyone who already shared or previewed that link will keep seeing the old cached version until you force a re-crawl through the platform's own debugging tool, such as Facebook's Sharing Debugger, LinkedIn's Post Inspector, or X's Card Validator.
The crawler needs to reach the image directly, not just see it in a browser
The URL in your og:image tag needs to be a full, absolute HTTPS address that's publicly reachable without any login, and not blocked by robots.txt for that platform's crawler. A relative path, or an image sitting behind authentication, fails silently, the crawler simply gives up and no preview card appears at all, rather than showing an error you'd notice right away.
Stick to JPEG or PNG for this one image
Elsewhere on a modern site, WebP or AVIF is usually the better default. For the og:image specifically, the crawler bots these platforms use to scrape link previews sometimes lag behind consumer browsers in format support, so JPEG or PNG remains the safest choice for this one image even on a site that otherwise serves WebP or AVIF everywhere else.
Keep the file light, since the crawler has its own limits
Most platforms cap the size of the image their crawler will fetch, typically a few megabytes, and a slow-loading image can cause the crawl to time out before a preview ever gets generated. A JPEG in the few hundred kilobyte range at 1200x628 loads quickly enough to avoid that entirely, without any visible quality loss at the size a preview card actually displays.