How to Find Xiaomi Vacuum Token: The Complete Guide

Modern cleaning robots from Xiaomi and the Mijia ecosystem are not just cleaning gadgets, but full-fledged smart home nodes. To deeply integrate devices such as the Roborock S5, Xiaomi Vacuum 1S or Dreame D9 into automation systems like Home Assistant or for working with local APIs, standard application settings are often not enough. The key element of access is the device token, a unique 32-character key that serves as a digital pass for controlling the robot.

Many users have difficulty moving beyond the standard functionality. The official Mi Home app hides this information from the average user, as it is designed for developers and enthusiasts. However, without this key, it is impossible to set up automatic turn on when leaving the house through third-party gateways or receive advanced cleaning statistics to the local server.

In this article, we will look at proven ways to get a token for different models of vacuum cleaners. We will look at both methods using PCs and emulators, and simpler options through cloud services.

Why do we need a token and where does it apply?

A token is an authentication key that allows external systems to communicate with your vacuum cleaner directly, bypassing some cloud restrictions or using alternative protocols. In the IoT ecosystem, it is a standard security measure. Without a token, a third-party application will not be able to prove to Xiaomi's server that it has the right to manage your Roborock or Viomi.

The main application is integration with the Home Assistant platform, a popular open-source smart home system, and once you get a token, you can:

• 🤖 Start cleaning on a schedule depending on the weather or the presence of people at home.
• 🗺️ Get real-time cleaning cards with high detail.
• 🔋 Control the wear of filters and brushes more accurately than in a standard application.

The token is also needed to use specialized scripts in Python or Node-RED, which can, for example, send a notification to Telegram if the vacuum cleaner is stuck, or turn it on only at night when electricity rates are lower.

⚠️ Warning: Never give your token to anyone else, and it allows you to gain full control of your device, including starting the motor or changing your Wi-Fi settings.

It is important to understand that different protocols may require different types of keys, but 99% of the time, a “token” refers to a 32-character hexadecimal string tied to a key. MAC-address.

Modern cleaning robots from Xiaomi and the Mijia ecosystem are not just cleaning gadgets, but full-fledged smart home nodes. To deeply integrate devices such as the Roborock S5, Xiaomi Vacuum 1S or Dreame D9 into automation systems like Home Assistant or for working with local APIs, standard application settings are often not enough. The key element of access is the device token, a unique 32-character key that serves as a digital pass for controlling the robot.

Many users have difficulty moving beyond the standard functionality. The official Mi Home app hides this information from the average user, as it is designed for developers and enthusiasts. However, without this key, it is impossible to set up automatic turn on when leaving the house through third-party gateways or receive advanced cleaning statistics to the local server.

In this article, we will look at proven ways to get a token for different models of vacuum cleaners. We will look at both methods using PCs and emulators, and simpler options through cloud services.

Why do we need a token and where does it apply?

A token is an authentication key that allows external systems to communicate with your vacuum cleaner directly, bypassing some cloud restrictions or using alternative protocols. In the IoT ecosystem, it is a standard security measure. Without a token, a third-party application will not be able to prove to Xiaomi's server that it has the right to manage your Roborock or Viomi.

The main application is integration with the Home Assistant platform, a popular open-source smart home system, and once you get a token, you can:

• 🤖 Start cleaning on a schedule depending on the weather or the presence of people at home.
• 🗺️ Get real-time cleaning cards with high detail.
• 🔋 Control the wear of filters and brushes more point-by-point than in a standard application.

The token is also needed to use specialized scripts in Python or Node-RED, which can, for example, send a notification to Telegram if the vacuum cleaner is stuck, or turn it on only at night when electricity rates are lower.

⚠️ Warning: Never give your token to anyone else, and it allows you to gain full control of your device, including starting the motor or changing your Wi-Fi settings.

It is important to understand that different protocols may require different types of keys, but 99% of the time, a “token” refers to a 32-character hexadecimal string tied to a key. MAC-address.

Method 1: Using the Xiaomi Cloud Token Extractor

The easiest and most secure method for most users is to use specialized online services or local utilities that request data from Xiaomi servers. One of the most popular tools is the Xiaomi Cloud Token Extractor, which does not require root rights on the phone or complex manipulation of code.

The principle of operation is to log in through your Mi Account, and the service receives a list of all devices associated with your region and issues their tokens, the process is as follows:

1. Go to the tool’s website (e.g., a project on GitHub or its web version).
2. Enter the username and password from your Mi Account.
3. Select the region you specified when registering (often “Europe” or “Russia”).
4. Press the "Get Tokens" button.

After processing the request, you will see a table with all the devices. Find your vacuum cleaner (for example, roborock.vacuum.s5) in the list and copy the corresponding string of the token.

Xiaomi periodically changes security algorithms. If the standard web interface does not work, you can use the desktop version of the utility that emulates requests more accurately. Also make sure that the account does not include two-factor authorization, which can block third-party scripts from entering (it can be temporarily disabled in security settings).

Method 2: Android Emulator and Traffic Sniffing

For advanced users who don’t want to share their data with third parties, there is a method of local token interception, the essence of the method is to create a local server through which Mi Home application traffic passes, which will require a computer (Windows, macOS or Linux) and an Android emulator, for example, NoxPlayer or Bluestacks.

You'll need a python-miio utility or a specialized script in Python that raises a proxy server.

pip install miio


miio extract-tokens

But the more reliable way is to use pre-built sniffer scripts that create a virtual hotspot. You install the Mi Home app inside the emulator, you set up a proxy in the emulator to create a virtual hotspot. IP-The address of your computer where the sniffer is running, and then you log in to the app account inside the emulator.

When you log in, the application sends a request to the server, and the sniffer intercepts the response that contains the token, and in the computer logs, you'll see a line of the type:

Device: vacuum cleaner


Token: 32 characters of hex code




IP: 192.168.1.XX

⚠️ Note: When using emulators, some versions of the Mi Home app may not run or require an update to Google Play Services. APK-file.

This method is more difficult to set up, but it ensures that your password doesn't go anywhere. It's the most secure way in terms of data privacy.

Method 3: For users of Home Assistant (Xiaomi Miio)

If your ultimate goal is integration into Home Assistant, then the process of getting a token is often built into the integration setup process. Xiaomi Miio's official integration allows you to get a token right in the HA interface, if you know the credentials.

When you add a device through the Settings menu → Devices and Services → Add integration, select Xiaomi Miio.

• 📍 host (IP-vacuum address on the local network).
• 🔑 Token (if known).
• ☁️ Or Mi Cloud account details.

If you choose to log in through your account, the integration itself will try to pull the token out of the Xiaomi cloud and save it locally. Once the device is successfully added, the token can be found in the configuration file. core.config_entries In the Home Assistant Data Folder.

It's important: IP-The vacuum cleaner address should be static if the router gives the device a new one. IP After restarting, integration will stop working. DHCP (binding IP down MAC-address) in your router settings.

Comparison of methods of obtaining a token

To make it easier for you to choose the right method, we have prepared a comparative table, each method has its pros and cons depending on your technical background.

For most users, the best choice is to use the first method or integration in Home Assistant. The emulator method is worth choosing only if the automatic methods have stopped working due to Xiaomi security updates.

Typical problems and their solution

The process of obtaining a token does not always go smoothly. Often users encounter an error "Invalid credentials" or "Device not found." This may be due to the wrong server region. In the Mi Home application, the region changes in the profile, but the server binding of the device remains on the server that was selected when the vacuum cleaner was first set up.

If you change your region in the app, the device may disappear from the list. Go back to the original region. Also, problems may arise if you use a Xiaomi account associated with social networks (Facebook, Google), in such cases, it is recommended to create a temporary password for third-party applications in the security settings of the Mi Account and use it instead of the main password.

Critically, the token is tied to a specific device. If you drop the vacuum cleaner to the factory settings (Power + Home buttons at the same time) and tie it back again, the token may change!

If a token is changed, it will have to be retrieved by any of the methods described above, so always keep the current token in a safe place before resetting the device.

💡

Save the token in the password manager or write it down on a piece of paper and glue it under the vacuum cleaner, which will save you from re-extracting the complex extraction procedure in the future.

Frequently Asked Questions (FAQ)

💡

The token is the key to local management, and without it, the vacuum cleaner is a black box, managed only through the cloud, and getting the token unlocks the full potential of the device.