I look this up all the time, wanted to document it here so I know just where to find it.  With this, I end up with a subdirectory in the production site named dev.  I then make that a separate named virtual host in my apache configuration, and protect the development environment with htpasswd authentication.
Naturally replace all the italics with your environment needs.

NOTE:  Do not do any work in development until you have completed all the steps!