Good question. Same origin policy always applies so if you aren’t going to backdoor the browser as a bypass you need to in the same domain. The primary limitation then is that you must own the site you wish to automate, or run a replication of the site from either localhost or a domain you own.

I recommend running the site from an aliased subdomain. This will allow ownership of https certificates with a wildcard to your primary domain and that subdomain can point to the environment that contains your site database or services. You can also have a subdomain that uses production https certifications but resolves to a loopback IP like https://localhost.example.com pointing to 127.0.0.1 and/or a AAAA record pointing to ::1.