See here: https://docs.joinmastodon.org/methods/oauth/

With the following code I get an empty string:
 xhr.setApi("/oauth/authorize");
 xhr.clearParams();
 xhr.setParam("response_type","code");
 xhr.setParam("redirect_uri","urn:ietf:wg:oauth:2.0:oob");
 xhr.setParam("client_id",app.client_id);
 xhr.setParam("force_login",true)
 xhr.get();

Am I supposed to give username and password with this API? I can't show the website in the app, that would require a dependency to Qt Webengine...

I guess that there is no way around showing the site in a browser component, because that's how OAuth is normally used.

@heluecht
The process requires multiple steps.
E.g. registering an application.
E.g. authorizing an user.

And no, you don't use an user name or password with the #API.
Tokens are used.

Getting started with the API
https://docs.joinmastodon.org/client/intro/