How does authorization by `origin` work?

I'm trying to allow an application to authenticate/authorize(?) itself by using Origin. From SolidOS interface, I changed the sharing permission to a file by adding "A Web app (origin)".

For simplicity, let's assume I have the following:

• http://localhost:9000
• https://my.domain
• http://my.other.domain

How do I make the query from my application?
In particular, my application is CLI-based -- in fact, it is a long-running service.

My attempts:

I did not find the relevant document on how the request should work. Therefore, I'm using the most naive method: add Origin: xxx (where xxx is one of the origins) to the HTTP request header. For example (using httpie):

https GET https://URL/TO/my_res.ttl Origin:https://my.domain

But this does not work. I encountered slightly different behaviours:

• For NSS (solidcommunity.net), I get 401 Unauthenticated
• For CSS, I get 401 Unauthorized

If omitting the protocol (I assume this is incorrect by nature, as origin needs to have a protocol), I encounter:

• For NSS (solidcommunity.net), I get NamedNode IRI "my.domain" must be absolute
• For CSS, I get 401; the server prints [PermissionBasedAuthorizer] {Primary} warn: Unauthenticated agent has no read permissions in the console

Start by reviewing the issue's examples for SolidOS, NSS, and CSS, including the Origin header requests and their 401 or IRI errors. Determine the supported authorization flow for origin-based access from a CLI service, then document the request format and expected behavior for the listed origins.