Where to get a token robot vacuum cleaner Xiaomi on Android: all working methods

Robot vacuum cleaners Xiaomi and Roborock require a special authorization token to integrate with third-party smart home systems — from Home Assistant to Alice or Google Home. Without this 64-digit code, connecting to alternative platforms is impossible. The problem is that Xiaomi actively hides tokens in the latest versions of the Mi Home app, and there are no official ways to obtain them.

On Android, the situation is complicated by the limitations of the operating system: unlike iOS, where the token can be extracted through the use of the Internet. HTTP-Proxies, this requires more complex manipulations, and in this article we will discuss 5 current methods (including bypassing protection in 2026), their pros/cons, and also give a checklist for safe extraction of the token without blocking the account. Some methods require technical skills – if you have never worked with a person ADB or MITM-Proxy, start with the simplest options.

What is a robot vacuum cleaner token and why you need it

The token is a unique session identifier that the Mi Home app receives from Xiaomi servers after authorization. It is valid for 30 days to 1 year (depending on the type of account) and is used to send commands to the device through the cloud. Without the token, third-party systems cannot:

• 📍 Manage the vacuum cleaner on a schedule (for example, through Home Assistant)
• 🔄 Get status (charge, errors, cleaning card)
• 🛠️ Integrate with voice assistants (Alice, Google Assistant)
• 📊 Create automation (for example, starting cleaning when leaving home)

Xiaomi officially only allows vacuum cleaners to be operated through its app, but enthusiasts have found workarounds, the main difficulty is that the token is not stored in the open form in the memory of the phone, it must either be intercepted during transmission or extracted from the encrypted data of the application.

⚠️ Note: Some methods (e.g., using Packet Capture) may raise suspicions about the security of your account. If you use one Mi Account for multiple devices, create a separate account specifically for the vacuum cleaner, this will reduce the risk of blocking your account.

Method 1: Retrieving a token through Mi Home (no root, for older versions)

This method worked until mid-2023 and is suitable for Mi Home 6.. and below. In newer versions (7.0+), the token is encrypted, so the method may not work. Check the version of the application in Settings → About the program.

Instructions:

1. Install Termux on your phone (or use ADB from PC).
2. Connect your phone to your PC and execute the command for the Mi Home memory dump: adb shell dumpsys package com.xiaomi.smarthome
3. In the conclusion, find the line token: this is your token. If there is no string, move on to the next way.

If the terminal returns the permission denied error, then the device has MIUI protection from reading these applications, in which case only root or alternative methods will help.

Method 2: Intercepting a token through HTTP-proxy (MITM)

This method works on any Mi Home version, but requires a proxy server setup.We will use Packet Capture (Android) or Fiddler (PC) to intercept traffic.

Step-by-step:

1. Install Packet Capture and turn it on SSL-interception.
2. Start recording traffic and open Mi Home.
3. Go to the section with your vacuum cleaner and wait for the data to load (5-10 seconds).
4. Stop recording and search the logs for requests to the domain api.io.mi.com.
5. In the body of the answer, look for the token field:... — this is the right token.

⚠️ Note: When using proxy, Xiaomi may block your account for “suspicious activity.” To reduce risks, do not intercept traffic for longer than 2-3 minutes and do not use this method more than 1 time per month.

Method 3: Use of the Miio extractor utility (for PC)

If previous methods didn’t work, try the specialized utility miio extractor.It analyzes traffic between the phone and Xiaomi servers, automatically extracting tokens.

Algorithm of action:

1. Download and install miio extractor on PC (Python 3.8+ is required).
2. Connect your phone to your PC via USB and enable USB Debugging (Settings → About Phone → MIUI Version (click 7 times) → Additional → For Developers).
3. Launch the utility with the team: Python miio_extractor.py
4. On the phone, open Mi Home and wait for the vacuum cleaner to load the data.
5. The utility will automatically display the token in the console.

The advantage of this method is automation: you don’t have to manually search for a token in the logs, but it requires command line skills and may not work on the latest versions of Mi Home (due to the changed encryption protocol).

💡

If the utility doesn’t find the token, try disabling two-factor authentication in your Mi Account while you extract it, sometimes bypassing additional security checks.

Method 4: Receiving a token through a Mi Account (cloud method)

This method does not require access to the phone, but only if you know the username / password from the Mi Account account associated with the vacuum cleaner. API token-extract.

Instructions:

1. Go to account.xiaomi.com and log in.
2. Copy cookies from your browser (use the EditThisCookie extension for Chrome).
3. Send. POST-request https://account.xiaomi.com/pass/serviceLoginAuth2 with parameters: {"user": "your login", "hash": "md5_Password, "clientsign": "cookie_step-by-step_2" }
4. The answer will be the ssecurity field, a temporary token that can be converted to permanent through a Python script.

Use a script to automate the process mi_token_extractor. It converts a temporary token into a permanent one suitable for Home Assistant.

⚠️ Note: This method violates Xiaomi’s user agreement.If you use it too often, your account may be blocked for “unauthorized access.” We recommend backing up the token and updating it no more than 1 time every 2 months.

Method 5: Retrieval of a token with root rights (100% working)

If your phone has root access, the token can be extracted directly from the Mi Home database, which works on all versions of the app, including the latest.

Step-by-step:

1. Install Root Browser or any other file manager with root support.
2. Go on the path: /data/data/com.xiaomi.smarthome/databases
3. Copy the file. miio_device.db PC-only.
4. Open it with DB Browser for SQLite.
5. In the table of devices, find a line with your vacuum cleaner - the token will be in the token column.

If there's no token, it's encrypted. In this case, use a script. mihome_decrypt, which decrypts the database based on the device key.

How to check the performance of the token

Before you use the token on third-party systems, check its validity.

1. Install DeCONZ or Home Assistant.
2. Add a vacuum cleaner as a Xiaomi Miio device by entering IP-address.
3. If the connection is established, the token is valid. If there is an Invalid token error, repeat the extraction procedure.

You can also check the token through Python:

from miio import Vacuum


vacuum = Vacuum(ip="192.168.1.100", token="YOUR_TOKEN")




print(vacuum.status())

If the script returns the vacuum cleaner data (charge, status) – the token is correct. Miio.exceptions.AuthenticationError error means that the token is incorrect or expired.

💡

The token is valid for 30 days to 1 year. If the vacuum cleaner has stopped responding to commands from third-party systems, the first thing to do is update the token. Some actions (for example, dumping the vacuum cleaner to factory settings) lead to the token being canceled.

Frequent mistakes and their solutions

When you extract a token, you're faced with typical problems, and here are the most common ways to solve them:

If none of the methods worked, check:

• 🔌 Is the vacuum cleaner connected to the same Wi-Fi network as the phone.
• 📱 Is the Mi Home app updated to the latest version (sometimes rollback helps).
• 🔒 Is Two-Factor Authentication enabled in your Mi Account.
• 🛡️ Does the antivirus/firewall block traffic (disable them while you extract them).

FAQ: Answers to popular questions