Integrating smart tech into a single ecosystem often requires access to hidden device parameters. Owners of robotic vacuum cleaners Xiaomi and Roborock face the need to obtain a token when trying to connect the device to third-party platforms such as Home Assistant, ioBroker or Yandex.Smart Home.
This unique 32-character key serves as a digital pass that allows external systems to manage cleaning, receive the status of cards and supplies. Without it, full automation of smart home scripts is impossible, since the standard Mi Home application does not provide direct access to the device’s API.
The procedure for extracting data may seem difficult for an untrained user, but there are proven methods that do not require deep knowledge of programming. Below we will discuss in detail the current ways to obtain a security key for your janitor model.
What is a token and why is it needed
The token is a unique security identifier that is generated when a device is linked to a Xiaomi account, and is used to encrypt local traffic and authorize commands between the application and the hardware. Without this key, any request to start a cleanup or return to the base will be rejected by the server.
The main reason users have to search for this code is to go beyond the limited functionality of official software, which allows third-party systems to create complex scenarios, such as running a cleaning only when no one is home or sending a notification to Telegram when the filter clogs.
⚠️ Warning: Never give your token to anyone else. IP-The address of your device on the local network, an attacker can gain full control of the vacuum cleaner, including access to the camera (if any) and microphone.
It's important to understand that the token is not just tied to the device, but also to a specific account, and if you reset the vacuum cleaner settings or change the region of your Mi Home account, the old key will become invalid and you'll have to repeat the procedure again, a security measure implemented by the company's engineers.
Preparation for the extraction of the access key
Before you start technical manipulation, you need to make sure your hardware and software environment is ready to go. Xiaomi’s modern ecosystem uses different communication protocols, so old methods may not work on new models with updated firmware.
You'll need a smartphone running Android or iOS with the Mi Home app installed, make sure you're using the version of the app that you first set up the robot with, and you'll need a stable Internet connection.
- 📱 Smartphone with an active Xiaomi account, to which a vacuum cleaner is tied.
- 📶 The device must be in the same Wi-Fi network with the router (for local methods).
- 🔑 Login and password from the account (do not use temporary login codes by SMS, if possible).
- 💻 Computer (preferably) to work with console utilities, if a complex method is chosen.
There is a common misconception that you need a computer to get a token, and in fact, most current methods allow you to perform all the actions directly from your mobile phone using special sniffer applications or plugins.
💡
Before starting the procedure, back up important data in the Mi Home app if this feature is available for your model to avoid losing your map history.
The method through Xiaomi Cloud Token Extractor (web version)
One of the simplest and most popular methods is to use a specialized web service that requests data from the Xiaomi cloud server, which does not require installing additional software on your computer, just a browser and the Internet.
The principle of this is to emulate the request of an official application, where you enter your credentials, the service logs in to Xiaomi's server and gives out a list of all the associated devices along with their tokens, which is safe, since the data is transmitted directly to the manufacturer's servers, bypassing third-party databases.
To start, go to the tool’s website (for example, miio/token_extractor Enter your account login and password, and the system may request a confirmation code if two-factor authorization is enabled.
| Parameter | Description | Where to find out. |
|---|---|---|
| User ID | Unique user number | Profile at Mi Home |
| Token | 32-character access key | The result of the extractor's work |
| IP Address | Local address of the device | Router or plugin settings |
| Model | Device model (e.g. rockrobo.vacuum.v1) | Device information |
Once you've successfully logged in, you'll see a list of all the devices, and find your robot vacuum cleaner by name or by name. MAC-Copy the value of the token -- that's the string of characters you want. Save it in a safe place.
💡
The web method is ideal for beginners, as it does not require Python installation or command line work, but requires trust in a third-party service.
Use plugins for Mi Home (Android)
Android smartphone owners can use modified versions of the app or plugins that display hidden technical information, one of the quickest ways to do so without requiring passwords on third-party sites.
There is a popular plugin called Vevs Mi Home or built-in features in some custom builds. Once the plugin is installed and the main application restarted, a new tab or button will appear in the device card “Info” / “Properties”.
The technical data menu that opens will have a token field, and you just have to copy it, and if the standard plugin doesn't display the token, you can use the Get Mi Home Tokens utility available in GitHub repositories or specialized forums.
⚠️ Note: Using modified versions of apps can result in Xiaomi servers blocking your account for suspicious activity.
An alternative for Android is to use traffic sniffer apps like HttpCanary or Packet Capture, where you need to start recording traffic, open the Mi Home app, and perform the vacuum cleaner action (on/off). You need to find the domain api.io.mi.com in the request logs and search the token parameter in the query body.
☑️ Check before using the plugins
Method of Snipping Traffic via Wi-Fi (Universal)
This is considered the gold standard of security because it does not require the transfer of a password to third parties, and it is based on the analysis of network traffic between the application and the server, and it will require a computer with installed software to intercept packets, such as Wireshark or Charles Proxy.
The idea is to get your smartphone to use your computer as a gateway to the Internet, and all the data that goes through that channel is analyzed, and you have to filter out HTTPS traffic and find queries to the domains xiaomi.com or mi.com.
Inside the encrypted HTTPS You can't see traffic without a root certificate on your phone, and once you have the certificate installed (the procedure is described in the documentation for Charles Proxy), you can see the contents of the queries. POST-requests in the body of which the JSON token.
GET /app/v2/device/miio.info?did=12345678
Host: api.io.mi.com
...
Response: {"token": "abcdef1234567890...", "model": "roborock.vacuum.s5"}This method is more difficult to set up, especially on iOS, where the installation of certificates is limited by security, but it ensures that your credentials do not leak. For Android, the process is simpler and takes about 10-15 minutes.
What to do if the traffic is not readable?
Problem Solving and Frequent Errors
Users often face typical problems in obtaining a token, and understanding the reasons for this will help them achieve results faster, and most often errors are associated with choosing the wrong server or region in the application.
If the token issuing service writes "Invalid credentials" or "Device not found", check the account region. Devices tied to a Chinese server will not be visible if you log in through the European gateway, and vice versa. Switch the region in the application settings or select the appropriate server in the extraction tool.
- 🚫 Authorization error: Check if you are using the login Facebook/Google, If the tool requires a username/password, then you need to create a password for applications in the settings of the Xiaomi account.
- 🚫 Empty device list: Make sure the vacuum cleaner is online and displayed in the app. sometimes it helps to re-tether the device.
- 🚫 Wrong token format: The token is always 32 characters (hex). If there are fewer or more characters, you copied the wrong field.
Another common problem is changing the token after flashing or resetting, so if you dump the vacuum cleaner to the factory settings, the old token will stop working, you'll have to re-link the device and retrieve the new key.
⚠️ Warning: Don't try to use the same token for multiple devices.Every gadget in the Xiaomi ecosystem has its own unique security identifier.