I figure this out from the source code. https://github.com/haiwen/seahub/blob/master/seahub/api2/serializers.py#L114
Just need to add -H "X-SEAFILE-OTP: 123456" to the curl request.
The whole command looks like:
curl -d "username=username@example.com&password=123456" -H "X-SEAFILE-OTP: 123456" https://cloud.seafile.com/api2/auth-token/
Need to update Web API doc for this option.