In general, Pastel does work with non-public URLs such as staging sites, even staging sites that are password-protected - you'd just need to log in through the canvas. As long as the sites can be reached by our servers, you should be able to create a canvas for them.
If you experience trouble accessing your site, or if your site is restricted to be accessible only by IPs you've specified, we recommend whitelisting Pastel's specific IPs on your staging server. This will keep Pastel working on your site.
Our IPs are:
128.199.138.34
104.248.38.109
167.71.247.201
164.92.70.134
138.197.146.55
128.199.2.140
143.198.130.217
170.64.149.59
While our proxies rarely change, we do have an internal secure list of people who have whitelisted our IPs, and we use that to directly inform each user about the change right away. And for security purposes, Pastel's proxy only works within Pastel canvases.
If you need any further help, please contact us on our chat at the bottom right of the page or by email at hello@usepastel.com.