Newline before {

const ...

const auto&

Isn't the casing fixed? Can it really vary?

rs -> resource

get -> create

+ QLatin1String("//authorizations")

is the double-slash really needed?

QByteArrayLiteral

QStringLiteral

QLatin1String("Authorization: Basic ") + QString::fromUtf8((name.toUtf8() + ':' + password.toUtf8()).toBase64())

QLatin1String for the string literal in the middle

QStringLiteral for the responsecode

QSL

QSL

QSL

"x-github-otp: required: Still incorrect casing. Does this work?

https://developer.github.com/v3/auth/ says it's X-GitHub-OTP: required;

Please pass m_tfHttpHeader via twoFactorRequested() instead I.e. add a parameter to that function. That way you can save the extra member in this class for m_tfHttpHeader.

And in general: Please refrain from adding less known abbreviations to symbol names; it makes reading code harder.

Rename: twoFactorRequested -> twoFactorAuthRequested

https://developer.github.com/v3/auth/ says it's X-GitHub-OTP: required;

Than it lies :)
It's actually lowercase.
Anyway, just making it case-insensitive...

And in general: Please refrain from adding less known abbreviations to symbol names; it makes reading code harder.

m_tfHttpHeader was created by the previous author, not me