Where to see the token robot vacuum cleaner Xiaomi: the full guide

Owners of modern smart equipment from Xiaomi often face the need to integrate their devices into alternative smart home systems such as Home Assistant, Homebridge or Domoticz. To successfully pair equipment with local servers and third-party platforms, it is critical to know the unique device identifier, which in the terminology of the Mi IoT ecosystem is called a token. Without this 32-digit hexadecimal key, managing a robot vacuum cleaner outside the official cloud becomes impossible.

Finding this key can seem like a daunting task for the untrained user, as the manufacturer deliberately hides it from the eyes of the average consumer for security purposes. However, there are several proven methods of extracting the token, which range from using third-party utilities on Android to more complex procedures with iOS emulators. In this article, we will discuss each method in detail so that you can choose the most suitable for your technical training.

It should be noted that the procedure for obtaining a token does not require disassembly of the device or soldering, but may require the temporary installation of specialized software. The token acts as a digital access key that allows your local server to log in to the device and send commands to it directly through the local Wi-Fi network. This provides instant response and operation even in the absence of the Internet.

Why do we need a token and where do we use it?

The main purpose of the token is to provide a secure communication between the control device and the command executor. The official Mi Home app receives this key automatically when it is first connected and stores it in the secure memory of the smartphone. However, when you decide to go beyond the Xiaomi ecosystem and connect a vacuum cleaner to the Home Assistant system or run a local miio server, you will need to manually extract this key and write it in the configuration files.

Using the token allows you to implement scenarios that are not available in a standard application. For example, you can set up automatic cleaning of the dust container when you reach a certain level of battery charge or start cleaning on a schedule depending on your location, without the delays typical of cloud servers. Local management through the token also guarantees the operation of the device even in the event of temporary failures on the manufacturer’s servers.

It is important to understand that the token is tied to a specific device and its MAC-If you dump the vacuum cleaner to the factory settings, the token will usually remain the same, but in rare cases, when you flash the Wi-Fi module, it may change. S50, Xiaomi Vacuum Mop or Dreame F9, extraction procedure is identical.

How to get a token through Android (Mi Home 5.x)

The easiest and most affordable way for most users is to use Android smartphones, which are a modified or special version of the Mi Home app that has a built-in network logging feature, and unlike the standard version of Google Play, this tool allows you to see real-time data exchange between your phone and vacuum cleaner.

You need to download it first. APK-A special application file, often referred to as "Mi Home Token Logger" or use a modified Mi Home build 5.x. Once installed, it is important to allow the application to access the network and, in some cases, request root rights, although modern versions can work without them, using locally available software. VPN-A traffic-snap tunnel, and when you run the app and connect to the vacuum cleaner, you'll see a string in the logs with the token key.

The process is this: you open the modified application, go to the log section and press the record start button. Then you open the official Mi Home app (or use the built-in modification browser) and control the vacuum cleaner. JSON-A response from the server containing the token and did field. Copy these values, as they will be needed to configure the integration.

⚠️ Note: Using modified versions of applications may carry potential security risks. APK-files only from verified open source sources to rule out malware introduction.

Extracting a token through an iOS emulator (Charles Proxy)

iPhone owners or users who prefer more detailed network analysis can use the method using a proxy server Charles Proxy, which is considered more versatile, since it does not require the installation of questionable data. APK-files, but it is technically more complex and requires a computer (Windows, macOS or Linux) and a smartphone connected to the same Wi-Fi network.

The essence of the method is to intercept HTTPS-The traffic between the Mi Home app on the iPhone and Xiaomi servers is installed on the computer, Charles, which acts as an intermediary, on the iPhone in the Wi-Fi settings is prescribed. IP-The address of the computer and the port listed in Charles, after installation of the security certificate (SSL Certificate on the phone, the program will be able to decrypt and display requests.

After you set up filtering in Charles (usually filtered by mi.com or miot.com), you need to open the Mi Home app on your iPhone and perform any action with the vacuum cleaner, such as starting a cleaning. POST-request, in the body of which (in the Request or Response tab) will contain the desired data: uid, did, token and mac. This method works for any version of iOS and does not require jailbreaking.

Receiving a token through Root Access and ADB

For advanced users with superuser rights (Root) or USB debugging (ADB) devices, there is a direct method of extracting a token from the application’s file storages, the most reliable method, since it allows access to the Mi Home application database, where tokens are stored in plaintext (older versions) or can be calculated.

If you have Root rights, you can use a file manager with access to system partitions and go on the path /data/data/com.xiaomi.mihome/files/. There may be a miio.cache file or a SQLite database containing device information. In newer versions of Android, access to this folder is closed even to root managers without special permissions, so often use the ADB command to upload the file.

adb pull /data/data/com.xiaomi.mihome/files/miio.cache ./miio.cache

Once extracted, the file can be analyzed using a text editor or specialized scripts in Python that will unravel the structure and give out tokens of all the associated devices, a method that requires high skill, since mishandling system files can lead to unstable smartphone operation.

Alternative methods and plugins Home Assistant

There are ways to get a token directly through the Home Assistant interface if you already have this system installed. Xiaomi Miio integration or third-party plugins like Xiaomi Cloud Map Extractor sometimes allow you to extract the token during the setup process if you provide them with credentials from a Mi Cloud account. However, this method is less reliable due to periodic changes to the Xiaomi cloud API.

Also worth mentioning are Linux utilities like miio (part of the python-miio project), which you can use the miio token command to try to get a token if the device has already been added to an Android/iOS application and the data is cached in a known location, but more often than not, this command is used to verify the health of the received token, rather than to extract it in the first place.

💡

If you use Home Assistant, try the integration of "Xiaomi Miio." In some cases, when you add a device through the interface, HA will itself request a username and password from the Mi Cloud and automatically extract the token, saving you from manual work.

Some users use Android emulators on PCs (such as BlueStacks or NoxPlayer) to install a modified Mi Home, which allows for the convenience of a large screen and Android methods without risking the main smartphone. The principle of operation remains the same: interception of traffic inside the emulator.

Checking the health of the token and typical errors

Once you have the 32-digit key, it needs to be checked. The easiest way is to use the command line with the python-miio package installed. The command miio --ip 192.168.1.X --token your token status must return the current vacuum cleaner state (battery charge, cleaning status, vacuum volume). If you see the answer from the device, then the token is correct.

A common mistake is confusion between the device token and the account token.The account token is longer and used for authorization in the cloud, while the device token (32 characters) is needed for local management. Also make sure that when copying you do not capture unnecessary spaces or string transfer symbols.

⚠️ Attention: Is the token sensitive to the character register? No, hexadecimal keys are usually register independent, but it is better to copy them exactly as they are displayed to avoid errors when entering into configuration files YAML.

If the status command returns a timeout error, check if your control server and vacuum cleaner are in the same subnet. Some routers have AP Customer Isolation, which prevents Wi-Fi devices from communicating with each other, which you need to turn off in the router settings.

💡

A successful response to the status command is the only reliable way to ensure that the token is extracted correctly and the device is available for local management.

Security measures when working with tokens

The token is the actual key to your device. Anyone who owns the key and is on your Wi-Fi network (or has access to it from the outside if the network is not protected) can control the vacuum cleaner: start, stop, change modes and even update the firmware. So it is crucial not to transfer the token to third parties and not to share screenshots of the config in the public domain.

Segmenting your smart home network is recommended, and separating IoT devices into a separate VLAN or guest network with limited access to your main home network, where your computers and smartphones with important data are located, minimizes the risk of one of the devices being compromised.

In case of suspected token leakage, the only way to protect the device is to completely reset Wi-Fi and re-bind it. When reconnected, the Wi-Fi module can generate a new token, although in most cases the key remains unchanged, and the reset simply breaks up old sessions.