Integrating smart tech into a single ecosystem often requires not only standard applications, but also a deeper dive into device settings. Owners of Xiaomi and Roborock robotic vacuum cleaners often face the need to obtain a special access key known as a token.This unique identifier is necessary to allow third-party control systems such as Home Assistant or Homebridge to communicate seamlessly with your device.
Without this cryptographic key, local control over Wi-Fi is impossible, because the Mi Home security protocol encrypts all commands. The Mi Home token acts as a digital password that confirms the user's rights to control a particular gadget. In this article, we will discuss in detail all the current ways to obtain this information for different operating systems.
The procedure may seem complicated only at first glance, but following a clear algorithm of actions will get you through the task in a few minutes.It is important to understand that the methods can vary depending on whether you are using Android or iOS, as well as the version of the operating system installed. The token consists of 32 characters in a hexadecimal format, and its loss or change when reassigning the device will require a repetition of the procedure.
Why do we need a token and where does it apply?
The main purpose of obtaining a token is to go beyond the standard functionality provided by the official Xiaomi Home application. Standard software limits the user to cloud commands that may have a delay, or does not allow you to create complex scenarios that depend on other devices in the house.
Most often, smart home platforms such as Home Assistant require an access key, which combines the vacuum cleaner with leak sensors, smart outlets, and security systems, such as when a motion sensor is activated in the hallway, the robot can automatically go to the cleanup when no one is home, or return to the base when watching a movie on a TV.
In addition, the token allows you to use alternative clients and scripts that can have advanced functionality compared to official applications, you can get more detailed statistics, manage a cleaning map at a deeper level, and integrate the device into voice assistants where official support is limited.
- 🤖 Local management without delays and dependency on the company’s servers.
- 🏠 Integration into complex smart home scenarios through Home Assistant.
- 🔧 Using third-party libraries and extensions for deep customization.
Preparation for obtaining a token through Android
The easiest and most common way to get the key is to use a smartphone or tablet running Android. This does not require root rights, which makes the method available to most users. You will need to install a special snifter application that will intercept network traffic between the official application and the server.
The first step is to install PCAPdroid, or its analogue from the Google Play Store, which is a modern and convenient tool that allows you to filter traffic and find the right lines of code without unnecessary difficulties. VPN-connection, as it is through the virtual tunnel will be the analysis of packets.
Next, you need to specify the target application in the Snifter settings. In this case, it is com.xiaomi.home (or com.xiaomi.mihome for older versions). It is important to choose the right package, otherwise the program will analyze all the phone traffic, which will make it difficult to find. Make sure that your phone and vacuum cleaner are connected to the same Wi-Fi network, although for the process of obtaining the token, the Internet connection is more important than the local network.
☑️ Preparation of Android-device
Once you start the snifter and select the target application, open the official Mi Home. Go to control your robot vacuum cleaner. Just open the device page so that the application sends a request to the server for status, at which point the snifter will write down the data packets.
Go back to the traffic analysis app. You need to find a query that contains the word miot or device. Inside that query, look for the token parameter. It will look like a long string of numbers and letters. Copy it, which is your key.
Search for a token on Apple iOS devices
For Apple ecosystem users, the process is slightly different because of the more stringent security constraints of the operating system. Standard sniffering methods are more complicated, but there are proven ways, one of which is using a macOS computer and Charles Proxy or Proxyman.
First, you need to install an SSL certificate on your iPhone. Without this step, you can't decrypt traffic, because all the data is encrypted. Once you set up a proxy on your computer and specify its address in your iPhone's Wi-Fi settings, you can start intercepting. Start recording traffic in the program on your computer and open the Mi Home app on your phone.
You'll need to search for a domain api.io.mi.com or something like that. JSON-There's a token field. Please note that on new iOS and updated Mi Home apps, this method may stop working due to the introduction of anti-money protection. SSL-scan (SSL Pinning).
⚠️ Note: If the Mi Home app doesn't connect to the Internet after configuring the proxy, check if the certificate is installed correctly. Often the problem lies in the system's lack of trust in the root certificate of the proxy program.
An alternative for iOS is to use paid sniffer apps available in the AppStore that work on a VPN, similar to PCAPdroid on Android. They avoid setting up a computer, but the functionality may be limited. Look for apps that request "HTTP Sniffer" or "Packet Capture."
What if SSL Pinning blocks interception?
Use of Mi Cloud Token Extractor
If mobile methods seem too complicated or don’t work, there is a way to get a token through a web interface and special scripts, a method often called “cloud” because it relies on logging into your Xiaomi account through an API, which would require a computer and an established runtime environment like Python, or using online services that provide such a service.
One of the popular tools is the Xiaomi Cloud Tokens Extractor project, available on GitHub. It is a script that logs into your account, gets a list of all the associated devices and uploads their tokens to a text file. It is a versatile solution that works independently of your phone's operating system.
To run the script, you will need your username and password from your Mi Account. Be very careful: enter data only in proven open source scripts. Once launched, the program will request a selection of the server region (for example, Europe, Russia, China) where your account is registered.
python extractor.py --username your_login --password your_password --region ruThe result of the program will be a list of all devices with their ID, MAC-Find your vacuum cleaner by model or name, and the good thing about this method is that it allows you to get tokens for all Xiaomi devices in the house, not just for one.
💡
When using scripts from GitHub, be sure to check the code for malicious strings or only use repositories that have a large number of stars and positive community reviews.
Decoding the structure of the token and identifiers
Understanding what you've got will help you avoid errors in entering data into configuration files, and a token is not just a random set of characters, but an important part of a security protocol, and it's used to generate encryption keys for each session of communication.
In addition to the token, you often need a DID (Device ID) and a Model to set up the integration. DID is a unique device number in Xiaomi’s system, assigned at first binding. The model is necessary to choose the right driver or plugin in the smart home system.
The table below gives examples of the data you may encounter in the analysis:
| Parameter | Example of meaning | Description |
|---|---|---|
| Token | 4a3b2c1d0e9f8g7h... | 32-character access key (hex) |
| DID | 123456789 | Unique device ID (number) |
| Model | roborock.vacuum.a10 | Technical name of the model |
| IP Address | 192.168.1.55 | Local address on the Wi-Fi network |
When you re-bind a device in an application (delete and add again), the token changes. This is done for security reasons. So if you update your router or reset your vacuum cleaner settings, you have to repeat the token search procedure. The old key will stop working immediately.
Problems and solutions
Users often face technical difficulties in finding a token, and one of the most common problems is an empty list of devices or the absence of a token in the logs, which may be because the device has not yet sent data to the server, or the application has cached an old response.
Try to perform an action that is guaranteed to require data exchange, such as starting a cleaning, changing the suction power or going to the card tab. Real-time status update will cause the application to request new data, which will contain the current token in the package.
⚠️ Warning: Never pass your token and Xiaomi account data to third parties. IP-Address, an attacker can gain full control of the device, run it remotely or change settings.
Another problem is using the Chinese version of the Mi Home app in China, in which case the servers may be located outside your country, and the sniffer may not have time to intercept packets due to delays or using other encryption protocols.
If none of these methods work, check if you are using them. VPN It's on the phone. VPN can redirect traffic bypassing the sniffer or change IP-address that causes authorization conflicts. Disable all third-party network filters before starting the procedure.
💡
The token changes only when you uncouple the device from your account. As long as the vacuum cleaner is tied to your Mi Account, the key remains constant, even if you change the router or password from the Wi-Fi.