How to find Xiaomi vacuum cleaner token on iPhone

Smart home owners often face the need to integrate devices deeply into the smart home ecosystem beyond the standard functionality of the Mi Home app. This is especially true for iPhone users who want to connect a Xiaomi or Roborock robot vacuum cleaner to HomeKit, Home Assistant or other advanced automation systems.

Receiving this key on iOS devices has historically been a challenge compared to Android systems because of the closed file system. However, modern methods allow you to extract the necessary information without jailbreaking or complex manipulation of the code. In this article, we will discuss current ways that will help you get a device token and expand the capabilities of your smart janitor.

It is worth noting that the process requires carefulness and accurate follow-through, as working with network settings and passwords requires care. We will look at both official methods and proven third-party utilities that have proven themselves among the community of enthusiasts. The token is a 32-digit hexadecimal string, unique for each device connection to a specific Wi-Fi network.

Why do we need a token and where do we use it?

The token is not just a random set of characters, but a critical security element of the Miio protocol used by Xiaomi to communicate between smartphones and smart devices. Without this key, third-party systems cannot send commands to the device because they cannot authenticate at the local level.

Using a token bypasses the limitations of regional servers, for example, if you bought a Chinese version of a vacuum cleaner and your account is registered in Europe, direct integration can be difficult. Local management via a token solves this problem by allowing you to control the device directly through the local network, bypassing the manufacturer's cloud servers, and it also increases response speed and ensures scripting even when there is no Internet.

⚠️ Warning: Never give your token to anyone else. Once you access this key, an attacker can have full control of your device, run a cleanup in your absence, or even access a room map and schedule.

In addition, the token provides access to hidden features that are not implemented in the standard Mi Home app. You can customize virtual walls through coordinates, change the suction power more flexibly, or get advanced statistics on resource consumption. For advanced users, this opens the door to a world of full automation of the home.

Preparing iPhone and Wi-Fi Networks for Token Receipt

Before you start extracting the access key, you need to make sure your infrastructure is ready to go. The main method available to iPhone users without jailbreaking is based on network traffic analysis or backups, so connection stability is paramount. Make sure your iPhone and robot vacuum cleaner are connected to the same Wi-Fi network, preferably in the 2.4 GHz band, as many Xiaomi models do not support 5 GHz.

You will also need to know the password from your Wi-Fi network. Unlike Android, where some utilities can read saved passwords, on iOS this process requires manually entering or using the Wi-Fi password function in the system settings if it is available in your iOS version.

For convenience, it is recommended to disable the function "Random address" for the duration of operations MAC" (Private Wi-Fi Address for your home network in your iPhone settings, which will prevent potential conflicts if the router strictly filters the devices over the iPhone. MAC-addresses, although for most modern routers this is not a critical requirement.

It's important to understand that the token is tied when the device pairs with the router. If you change the router, the Wi-Fi password, or the network name (SSID), the token received earlier will stop working, in which case the procedure for obtaining a new key will have to be repeated again after reassigning the device in the application.

Method 1: Using Miio (via PC/Mac)

One of the most reliable ways to get a token for an iPhone user is by using a computer (Mac or Windows) and python-miio or similar tools that interact with the local network. Since the iPhone does not allow applications to scan the local network as deeply as desktop OSes do, using an external computing device is the most effective solution.

The essence of the method is that the computer sends a special request to the local network, and the Xiaomi device, while in pairing mode or just in an active network, issues its token in response to the correct handshake.

The process is as follows: you install the necessary packages, you will learn. IP-The address of your vacuum cleaner on the local network (via router settings or the Fing app on the iPhone) and run a command to extract the token. If the device is already linked to the account, sometimes it requires temporary development or the use of special scripts to “pull” the token from the active connection.

pip install python-miio


miio device --ip 192.168.1.X --token YOUR_TOKEN info

However, if you don't know the token, you use special sniffers or brute force methods based on your Xiaomi account credentials, and there are ready-made graphical shells for this process that make it easier to enter data, you enter the username and password from your Mi Account, and the program finds the devices and their tokens.

⚠️ Note: Using third-party scripts with your login and password carries risks. It is recommended to temporarily change the password to a complex one-time one, get tokens, and then change the password from the Xiaomi account again for security.

Method 2: Analysis of iOS backup (for advanced)

For users who don’t want to use computer scripts with passwords, there is a method based on analyzing the local backup of the iPhone. Apps on iOS store data, including device tokens, in their sandboxes. When you create a full backup, this data is stored in encrypted or open form depending on the security settings of the application itself.

There are specialized utilities for macOS and Windows (such as iMazing or specialized scripts on GitHub like extract-mi-token) that can read the structure of application files from the backup. You will need to create a local backup of the iPhone on your computer, then run a utility that scans the files of the Mi Home application.

The database file or configuration file found will contain a string of tokens, usually a file with the extension.sqlite or.db, located in the depths of the application directories, searched by keywords or known token masks (32 characters).

This method is considered more secure from the point of view of transferring account data, since you do not enter your credentials into third-party programs, but only work with a local backup file.

Method 3: Change Wi-Fi password (Interception method)

The most technically interesting, but also more challenging, method for a beginner is to emulate an access point, and the idea is to make the vacuum cleaner think it's connecting to a new network, and at that point intercept the token that the device is transmitting for authorization, and to do this, a virtual access point is created on the computer with the name (SSID) of your home network, but with a changed password or monitoring mode.

When you start the Mi Home app on your iPhone, you start the Wi-Fi network change for the vacuum cleaner, the device goes into pairing mode. If at that point your computer that started the traffic sniffer (for example, Wireshark in conjunction with the monitor mode) is on the air, you can fix the data packets.

This method requires a deep knowledge of networking, additional software installed on the computer, and perhaps a dedicated Wi-Fi adapter that supports monitor mode. To the average user, this method may seem excessively complex, but it is the only option if other methods have not worked or the device is not cloud-based.

Common Errors and How to Resolve Them

When searching for a token, users often face a number of typical problems that can stop the whole process. One of the most common mistakes is choosing the wrong region in the application. If your account is registered in Russia, and the vacuum cleaner was originally set up in China, the servers may not give the correct data to generate the token, in which case creating a new account with the right region and re-associating the device helps.

Another common problem is using a guest Wi-Fi network. If your router isolates customers (AP Isolation), devices can’t “see” each other and requests for a token will go nowhere. Make sure that the router’s settings turn off customer isolation for your main network.

It’s also worth considering that some new models of Xiaomi and Roborock vacuum cleaners use updated encryption protocols that can block old methods of obtaining a token. In this case, waiting helps: sometimes tool developers update their scripts, and after a while after the release of a new vacuum cleaner firmware, a working method of hacking appears.

💡

If the token fails, try temporarily switching the region in the Mi Home app to China, and many devices use Chinese servers by default even when buying in other countries.

Remember, once you get a token, you have to save it in a safe place, and it's best to write it down to a password manager or an encrypted text file, and losing it when you change your router will require you to do it all over again, which can be tedious.

💡

The token is valid only for the current Wi-Fi network. Changing the router, network name or Wi-Fi password makes the old token invalid and requires obtaining a new one.

Integration with HomeKit and Smart Home

Once you have successfully obtained a 32-digit key, you can start integrating. For iPhone users, the most popular solution is to use the homebridge-xiaomi-roborock-vacuum plugin for the Homebridge platform, which allows you to add a vacuum cleaner directly to the Home app on iOS, Siri and widgets.

In the configuration file config.json You'll need to make it. IP-The device's address, model, and, of course, the token that you get, and when you reboot Homebridge, it'll appear in your smart home as a native Apple accessory.

An alternative is to use the Home Assistant platform, which also supports adding Xiaomi devices via a token, which gives even more flexible automation capabilities, allowing you to link the start of a cleanup to the iPhone’s geolocation or presence sensors.