Owning modern smart tech is often a fascinating quest, especially when standard functionality no longer meets the needs of the advanced user. Xiaomi’s robot vacuum cleaners and their sub-brands (Roborock, Dreame, Viomi) are famous for their effectiveness, but full integration into Home Assistant, HomeBridge, or using third-party plugins requires a unique access key. This key, known as a token, is the digital passport of your device, without which local command transfer is impossible.
Many users are faced with a situation where the Mi Home app is stable, but the attempt to add the device to the alternative ecosystem fails due to the lack of this secret code.Token is a 32-digit hexadecimal string that is generated when the device is associated with a Xiaomi account. Without it, any attempts to communicate directly with the robot over Wi-Fi will be rejected by the security server.
In this article, we will take a closer look at all the current ways to get a token in 2026, given the Chinese giant’s constant updates to security protocols. We will look at methods from simple scripts for PCs to complex manipulation of traffic sniffers, and discuss what to do if none of the methods work.
Why do we need a token and where does it apply?
Before you start searching, you need to understand the architecture of Xiaomi’s ecosystem: the company uses a closed encryption protocol to exchange data between the application and the device. The token acts as an encryption key that allows your local server or script to “pretend” to be an official application and give commands to the robot directly, bypassing cloud servers in China or Europe.
The most common way tokens are searched for integration into Home Assistant, a popular smart home platform that allows you to combine devices from different brands into a single interface. With a token, you get complete control: you can program the vacuum cleaner to start when you leave the house by geolocating your phone, or you can activate quiet mode while watching a movie on your TV.
⚠️ Warning: A token is confidential information, and by transferring it to third parties or entering it into unverified scripts, you theoretically give them complete control over your device, and keep the string in a safe place, and don't publish it in public.
The token is also required for custom cards in the Home Assistant (such as valetudo or xiaomi-vacuum-map-card), which allow you to see in real time the cleaning card, the current position of the robot and the battery level directly on the tablet mounted on the wall, without the token, these integrations will show the status of "Unavailable".
Preparation: What you need before starting
The process of extracting a token requires some preparation. You don't expect it to work out the first time without first setting up your environment. You'll need a computer (Windows, macOS or Linux) with Internet access and Python installed (version 3.7 or higher). Python is necessary to run extractor scripts that interact with authorization servers.
The second important component is the Xiaomi account itself, which the vacuum cleaner is attached to. Make sure you remember the username and password. If you have two-factor authorization enabled, prepare your phone to receive the confirmation code. It is also crucial to know the region of your account (China, Europe, Russia, USA), because their authorization servers are different, and an error in choosing a region will lead to the wrong result.
☑️ Checklist of preparations
Also, some methods require temporarily shutting the vacuum cleaner off the network or resetting it to factory settings, so make sure you have free time to do the procedure.If you use a Keenetic or Mikrotik router, you may need skills to set up routing rules or packet installation, but we'll look at simpler, more versatile ways as well.
Method 1: Use of plugins and extensions (the easiest one)
The most affordable method for beginners is to use ready-made browser plugins or specialized utilities that automate the process of obtaining a token. One of the most popular tools in the past is a browser plugin that intercepted tokens when logged into the web version of the cloud. However, due to increased security, this method is unstable.
A more reliable option is to use Xiaomi Cloud Map Extractor integration into Home Assistant, which, if you're already using this platform, allows you not only to get a token, but also to set up the card right away, and the process is you add integration, you enter your account, and the system extracts the keys for all the devices in the house, and it's safe because the code is open and verified by the community.
For Windows users, there's a tool called Xiaomi Vacuum Token Extractor, which is a graphics application where you just type in your login, password, and region, and it will contact the server itself, get a list of devices, and give you tokens, and it eliminates the need to work with the command line.
| Method | Difficulty | Skills required | Relevance 2026 |
|---|---|---|---|
| Home Assistant Plugin | Low. | Basic | Tall. |
| Python script (miio) | Medium | Work with the console | Medium |
| Traffic Sniffer (Fiddler) | Tall. | Advanced | Low (difficult) |
| Receipt through ADB (Root) | Very high. | Expert | Depends on the model. |
⚠️ Note: Exe files from unverified sources are at risk of stealing your account data, and it is recommended to use only open source scripts from platforms like GitHub with a large number of stars and an active community.
Method 2: Working with Python and the Miio Library
For those who are not afraid of the command line, the classic and most reliable way is to use the miio library (formerly known as python-miio), which works at the API level and allows you not only to get a token, but also to control the device. First, you need to install the library itself. Open the terminal or command line and type in the command:
pip3 install python-miioOnce installed, you will need a script to get the token. In the zvldz developer repository or in the official python-miio documentation, you can find current versions of the script. extract_tokens.py. The launch is carried out by a team where you specify your credentials. 2026 Xiaomi servers may require additional device hash transmission, so use only the latest versions of scripts.
If the script worked successfully, you will see a list of all devices in your account with their IP-address, MAC-And the tokens, you know, are going to be addresses, and most importantly, tokens, and you save that information, and the token will look like a long string of numbers and letters, 32b1c8d9e4f5a6b7c8d9e0f1a2b3c4d5). This is the line you will need to insert into your integration settings.