Integrating smart devices into a single ecosystem often requires going beyond the standard capabilities offered by the manufacturer. Owners of Roborock S5 Max robot vacuum cleaners often face the need to access the device’s hidden API to connect to third-party control systems such as Home Assistant or Node-RED. A key element of authorization in this process is a unique digital key called a token.
Without this parameter, local robot control is impossible, since the MiIO communication protocol developed by Xiaomi uses a strict encryption system. Knowledge of the token allows you to send commands directly to the device in the cloud, which greatly speeds up response and allows you to create complex automation scenarios. In this article, we will detail the proven methods for extracting the secret key for your model.
The process of obtaining data may seem difficult for an untrained user, but it does not require deep knowledge of programming. It is enough to follow the instructions carefully and have a computer or smartphone with administrator rights at hand. We will consider both software and hardware methods of solving the problem so that you can choose the most suitable option.
Why do we need a token and where does it apply?
The token is a string of 32 hexadecimal characters that serves as your device's digital passport on the local network. When you try to connect the Roborock S5 Max to an alternative software, the security system requests this key to confirm access rights, without which any attempts to communicate will be rejected by the device's gateway.
The main application is to create advanced smart home scenarios, such as setting up a cleanup start only when all the smartphones in the family have left the geofence of the house, or integrating voice control through local servers without cloud delays, giving you full control over navigation algorithms and suction power.
⚠️ Warning: Never give your token to anyone or publish it publicly.Knowing this key could theoretically give an attacker full control of your device within your Wi-Fi network.
The token is also needed to use specialized plugins and extensions that add functionality that is not available in the official Mi Home app, such as saving multiple floor maps, detailed filter consumption statistics, or managing sound files. For Android device owners, the process is often easier due to the openness of the system.
Preparation of equipment and software
Before you start extracting the key, you need to make sure your environment is technically compliant. You will need a computer (Windows, macOS or Linux) or smartphone, as well as a stable connection to the same Wi-Fi network that the robot is on. Make sure the Roborock S5 Max is online and displayed in the list of devices.
Debugging tools often require additional software installation. If you use a PC, you may need a Python package and a pip package manager. Android-based mobile devices will require installation of terminal emulation applications or specialized utilities for network protocols.
It is important to prepare the account to which the vacuum cleaner is attached in advance. In some methods, you will need to log in via a script, so the password should be at hand. It is recommended to temporarily simplify the password to a combination of numbers and Latin letters to avoid problems with encoding special characters when entering the console.
☑️ Pre-testing
Method 1: Using Python script on a computer
The most versatile and reliable method is to use the python-miio script, which interacts with Xiaomi servers to obtain a token, which is suitable for Windows, macOS and Linux users. First, install the Python programming language itself from the official website, making sure that the installation activates the option to add paths to the environment variables.
Once installed, open the command line or the terminal. You need to install the developer library. Enter the command to install the desired package through the pip manager. This action will download all the necessary dependencies to work with the MiIO protocol.
pip install python-miioNow that the toolkit is ready, you can start the process of obtaining the token. The script will send a request to the Xiaomi authorization server using your credentials. The server response will contain the desired string. Enter the following command by replacing the data with your own:
miio-cloud --username your login --password your password --region ruIn the list that appears, find your device named Roborock S5 Max or model ID. Next to the Token, copy it and save it in a safe place. If the list is empty, check the correct region (cn, ru, eu, us) in your Mi Account settings.
What if the script gives a captcha error?
Method 2: Getting a token through Android and Xposed
Android smartphone owners can use the method of intercepting the token directly from the device, which requires superuser rights (Root) and an installed framework Xposed or LSPosed.
You will need to install GetMiToken module or similar plugin for Xiaomi Cloud Token Extractor. After activating the module in the settings of the framework, you need to restart the device. Then open the Mi Home application and log in to your account.
The assistant app will automatically intercept the server's response when you load the list of devices, and the token will show up in a floating window or in the module's logs, and the advantage of this method is that it works even with two-factor authorization, since you log in through the official application.
- 📱 Make sure that the Android version is compatible with your Xposed version.
- 🔒 Provide the module with all necessary permissions to work in the background.
- 🔄 After receiving the key, it is recommended to deactivate the module for security reasons.
⚠️ Attention: Using Root rights and modified system frameworks can result in a denial of warranty service to your smartphone.
Method 3: Traffic analysis via emulator or Proxy
For advanced users who don’t want to install Python or get Root rights, there is a method of analyzing network traffic. The essence is to pass the Mi Home application traffic through an intermediate server (Proxy), which decrypts the network traffic. SSL-This is often done using an Android emulator on a PC, such as BlueStacks or Nox.
You install a traffic sniffer program on your computer, like Charles Proxy or Fiddler, and you install a security certificate on the emulator, and you set up a proxy connection in the emulator's Wi-Fi settings, you just open the Mi Home app.
You'll see a lot of requests in the software log. API, word-word device/list or home/device_list. In the parameters of this request or in the server response (JSON) It's going to contain a token field, and it's the most time-consuming, but it's also the most informative way to explore the whole data exchange.
| Method | Difficulty | I need a PC. | I need a Root. |
|---|---|---|---|
| Python-script | Medium | Yes. | No. |
| Xposed (Android) | Tall. | No. | Yes. |
| Proxy/Charles | Tall. | Yes. | No. |
💡
If you are using macOS, make sure that the security settings allow scripts to run from unknown sources, otherwise the system may block the Python script from working.
Solving and eliminating errors
In the process of extracting a token, users often face typical problems, one of the most common is the error "Invalid credentials" or "Wrong password." This can mean not only an input error, but also a locking of the account by the Xiaomi server due to suspicious activity, in which case it is worth changing the password in the official application and trying again.
Another common problem is that there is an empty list of devices after successful authorization, which happens if you select the wrong server region in the script settings. Accounts registered in China are on the cn server, European accounts are on the ru or de. Check which region is listed in the Mi Home application profile.
Network connectivity issues may also be possible. If your router uses complex security settings (AP Isolation, strict firewalls), the script may not reach the server or device. Try to temporarily distribute Wi-Fi from your smartphone to eliminate problems with your home network.
- 🌐 Check if the antivirus is blocking the script connection.
- 🔑 Make sure there are no special characters in the password that can conflict with the command line.
- 🤖 Make sure that Roborock firmware S5 Max Updated to the Latest Version.
💡
90% of errors in obtaining a token are due to the wrong server region or the blocking of an account by Xiaomi due to frequent requests.