Getting Xiaomi Vacuum token from a computer: an expert guide

Integrating Xiaomi or Roborock robotic vacuum cleaners into smart home systems like Home Assistant or OpenHAB requires a unique security identifier.This identifier, known as a token, is the key to allowing third-party software to manage your device locally.Without this 16-digit hexadecimal code, direct interaction with the vacuum cleaner outside the official cloud is impossible.

Users often wonder how to extract this private key using a personal computer running Windows, macOS or Linux, without having to buy additional hardware keys or disassemble the device. There are several proven software methods that allow access to tokens stored in Xiaomi's cloud infrastructure.

In this guide, we will go into detail about the algorithms of actions, necessary tools and possible pitfalls of the process.We will focus on secure ways of authorization through emulation of the mobile environment and analysis of network requests. The token is valid until you change the password from the Mi Home account or reset the device to factory settings.

Preparation for the extraction of the token: necessary tools

Before you start technical manipulation, you need to make sure your software environment is ready to go.The main obstacle is that the official Mi Home app does not display tokens in the user interface.

To work on a PC, you will need to install an Android emulator, since the scripts for obtaining a token are written primarily for this platform. The most stable solutions at the moment are NoxPlayer, BlueStacks or LDPlayer. It is important to choose an Android version at least 7.0 to ensure compatibility with modern versions of the Mi Home application.

You also need super-user (root) rights inside the emulator, and most modern emulators allow root access to be enabled in the settings immediately after installation, without which the script cannot read the secure configuration files of the application where the desired key is stored.

⚠️ Note: Using emulators on weak PCs can lead to a significant decrease in system performance.

Make sure you have a Xiaomi account that the vacuum cleaner is tied to. If you use different regions for different devices, remember that the token should be searched in the same region where the device is registered. Wrong server selection will lead to an authorization error.

Method One: Using Python script in an emulator

The most reliable and popular way to obtain a token is to use a miio script or specialized utilities such as: xiaomi_miio. This method involves installing the Mi Home app inside the Android emulator on your PC and running the parser script.

The process starts with installing the emulator and incorporating root rights. APK-Mi Home application file (preferably an older version, for example, 5.x, Because they're easier to analyze, but new ones work, too, and install it. Then you need to log in to the app and wait for the vacuum cleaner to appear on the list of devices.

Once you've successfully authorized and connected the device, you need to run a token script, and there are many off-the-shelf solutions, like the vacuum-xiaomi-token project, and the script goes to the emulator's file system, finds the application database, and extracts the tokens of all the connected devices from there.

It is important to configure the file path in the script correctly. Usually the database is located on the path /data/data/com.xiaomi.smarthome/databases/miio.db or in SharedPreferences files. If the script cannot find the file automatically, you will have to manually specify the path through the emulator console.

Step-by-step instruction: installation and start

For ease of perception, the algorithm of actions is broken down into sequential steps, following them minimizes the risk of errors, do not miss the steps of checking the settings of the emulator network, since the application must have access to the Internet for initial synchronization.

After installing all components, open the emulator terminal (or connect to it through it). ADB You need to copy the script file inside the emulator or run it locally if the emulator is scrawling through the files. The start command usually looks like python. get_token.py.

In the process, the script will ask for a username (email or phone) and password from your Xiaomi account. Enter the data carefully. After successful authorization, a list of devices with their ID and tokens will appear on the screen. Copy the 32-character hex code corresponding to your vacuum cleaner.

If you use two-factor authentication, the process can be complicated, as the script must be able to handle confirmation code requests, in which case it is recommended to temporarily disable 2FA in the Mi Account security settings.

Alternative method: Network Traffic Analysis (MITM)

A more complex but universal method is to intercept HTTPS-For this, a proxy server is installed on the PC, for example, Charles Proxy or Fiddler, which acts as an intermediary.

The method is to get the application to trust the proxy server certificate: you install the root certificate of Charles on the emulator (or real phone), set up a network connection through a proxy PC and run the application. Any request to the Xiaomi API in the proxy logs will appear data, including the token.

This method requires care, because the traffic is encrypted, and you'll need to find a specific request that contains a token or result with a long hex line, often transmitted when you start an application or update your device status.

⚠️ Note: Modern versions of Android (9.0 and higher) and Mi Home apps are used SSL Pinning, which blocks the proxy operation. APK-file or use of older versions of the OS in the emulator.

The advantage of the method is that it doesn't require root rights if you can bypass certificate verification, but in practice, without modifying system files or APKs, it's extremely difficult to do that, so emulator and root access remains a priority for beginners.

Compatibility table and parameters

Below is a table that will help you navigate the parameters you might encounter in the data extraction process. Different vacuum cleaner models and protocol versions can use different identifiers formats.

Understanding the difference between DID Token is critically important. DID — It's just a number, and the Token is a password. To set up local management in Home Assistant, you'll need both. IP-device address on the local network.

Use of the token for local management

Once you have successfully received a token, it needs to be implemented into the smart home management system, the most common scenario is to add a device to the Home Assistant, which allows you to control the vacuum cleaner without the delays typical of cloud servers and automate its operation.

In the configuration file configuration.yaml or through the graphical integration interface Xiaomi Miio you will need to enter IP-The system will verify the connection, and if the data is correct, the device will be available for control.

Local control gives you access to advanced features that may not be available in a standard application or are limited to a region. You can create complex scenarios, for example, start cleaning when all smartphones leave the geofence or stop the vacuum cleaner when water leak sensors are triggered.

⚠️ Note: When you dump the vacuum cleaner to the factory settings (usually by pressing two buttons), the token changes. You will have to re-go through the procedure for obtaining it to continue local management.

You can also use the token to write your own scripts in Python, Node-RED or other platforms. CLI-So, we're using an inters to test teams. --ip 192.168.1.X --token YOUR_TOKEN status will return the current state of the device.

Addressing common problems

Users often encounter errors in the process of obtaining a token, one of the most common being “Invalid credentials” or “Login failed,” which could mean that Xiaomi servers blocked the entry due to suspicious activity or an incorrect region.

Make sure that the script or emulator has the right server (Chinese cn, European de or US us).If your account is registered in the Russia/CIS region, it is usually a European server, but sometimes you need to search for options.

Another problem is that you can't install the app in the emulator. In this case, try downloading it. APK-file from a verified source, as the built-in Google Play store in emulators may not work correctly or not have the desired version of the application.

💡

If the script produces an SSL error, try temporarily disabling certificate verification in Python settings or use the --ignore-ssl argument if this is supported by a particular utility.

Remember that your account security depends on the security of the token. Don't share the code with third parties or share screenshots of it in public sources. By knowing the token, an attacker can gain full control of your vacuum cleaner on the local network.

FAQ: Frequently Asked Questions

💡

Obtaining a token is a one-off procedure necessary to move to an advanced level of smart home management, ensuring speed and independence from the cloud.