Right now, my collaborator demo at https://notabug.org/Houkime/mcfi uses the following scheme (it is a reduced one which omits OAuth):
Let's assume that alice@ServerA.com is wishing to add bob@ServerB.com as a collaborator for her project AwesomeRepo
POST at ServerA.com/users/alice/AsesomeRepo/collaborators/new
Result: 204 Successful operation
GET at ServerB.com/users/bob
'publicKey': 'ssh-rsa AABBBADSOQdasjasjdi123ead...'
And that's it.
Key is then imported and registered as a valid collaborator for AwesomeRepo.
And it works as can be seen in https://peertube.social/videos/watch/e65e0c70-d165-4c64-8518-3578d3d392d9 after the cryptic cartoon.
However, it probably should be wrapped into some form of Activity, esp. so that bob can be notified of the fact that he is now indeed a collaborator.