Integrating Xiaomi Vacuum Mop smart vacuum cleaners into a single smart home ecosystem often requires obtaining a unique device identifier known as a token. iPhone users face certain difficulties, as the iOS operating system has stricter file system access restrictions compared to Android. However, knowing this secret key is necessary for advanced configuration, integration with Home Assistant or the use of third-party plugins.
In this article, we will discuss in detail the current methods of extracting a token directly from a device running iOS. We will look at methods that do not require complex programming, as well as options for experienced users who are ready to use additional tools. Understanding the process will help you gain full control over your robot vacuum cleaner.
It is worth noting that the procedure can vary depending on the version of the operating system and the specific model of your gadget. Below are proven algorithms of actions that allow you to bypass the standard limitations of the Mi Home application and access hidden configuration data.
Why do we need a device token?
The token is a 32-character string that serves as the authorization key for local device management. Without this code, external systems cannot send commands directly to the robot vacuum cleaner, bypassing the manufacturer's cloud servers, which is critical to ensuring that automation scenarios run fast and work without delay.
Using the token allows you to integrate Xiaomi Vacuum Mop into systems like Home Assistant, which opens up access to advanced functionality, you can create complex scenarios that are not available in a standard application, for example, starting a cleanup when leaving the geofence or voice control through local assistants.
⚠️ Warning: Never give your token to anyone else. Once you have this code, an attacker can gain full control of your device, including access to a room map and cleaning schedule.
In addition, knowledge of the token is necessary to restore the device in the event of a reset or connection problems to the account, a kind of digital passport that confirms the owner’s rights to control a specific instance of Xiaomi equipment.
💡
Save the received token in a safe place, such as in a password manager or an encrypted note, so as not to lose access to advanced management functions.
Preparing iPhone for data extraction
Before you start technical manipulation, you need to make sure that your smartphone and vacuum cleaner are in the correct condition.Make sure that the iPhone has the latest version of the Mi Home app from the App Store installed, as the security mechanism may differ in older versions.
You will also need a stable Wi-Fi connection. It is important that both the smartphone and the robot vacuum cleaner are connected to the same wireless network. Different frequencies (2.4 GHz and 5 GHz) can create problems, so it is recommended to use the 2.4 GHz network for initial setup.
- 📱 Make sure that your iPhone has Wi-Fi and Bluetooth enabled.
- 🔒 Check that you are logged in to the same Mi Home account that the vacuum cleaner is tied to.
- 🔄 Restart the router if there are problems with connection stability.
It’s also worth freeing up some space on your device if you’re planning to use traffic logging techniques. Although modern methods don’t require huge resources, memory storage is never superfluous when working with system processes.
☑️ Preparedness for procedure
Method of obtaining a token through Mi Home (Official method)
In the latest versions of the Mi Home app for iOS, developers sometimes hide device information in the depths of the menu. Try to navigate to the device profile by clicking on the vacuum cleaner icon on the home screen. Then select the three-dot menu in the upper right corner.
Look for Device Settings or General Settings. In some regions and firmware versions, it may display token information, although most often it is hidden. If you see a 32-character string, you're lucky to copy it.
| Parameter | Description | Where to find out. |
|---|---|---|
| Model | Model of the device | Device profile |
| Token | Secret key (32 characters) | Hidden or in settings |
| IP Address | Local address. | Wi-Fi settings |
| MAC Address | Physical address | Device information |
If there is no explicit reference to the token in the application interface, it means that the manufacturer has hidden it from the average user, in which case move on to the more advanced methods described below, which allow you to “pull” this information out of network traffic.
Why is the token hidden?
Using traffic sniffers on iOS
The most reliable way to get a token on an iPhone is to analyze network traffic. To do this, you will need to install a special sniffer application that intercepts data transmitted between Mi Home and Xiaomi servers. A popular solution is the Stream app or analogues available in the App Store.
After installing the sniffer, you need to configure VPN-iPhone profile. The system will request permission to add configuration — agree, as it is necessary to route traffic through the analyzer app. Run the interception of traffic in the sniffer, and then open the Mi Home app.
Log in to control your robot vacuum cleaner and do any action, such as start cleaning or update status, at which point the app will send a request to the server containing the token, go back to the sniffer app and search the logs for domains containing miot-spec or xiaomi.
⚠️ Attention: Using sniffers can slow down the Internet on iPhone, as all traffic goes through additional processing. VPN-profile.
In the request body or the server response you will find JSON-So, you can copy the value of that field. That's the access key you want. It's a very careful method, but it's 100% accurate.
💡
Traffic sniffing is the most universal method for iOS, which does not require jailbreaking, but requires careful analysis of network logs.
Alternative methods through the web interface
There is a less technically complex, but sometimes working method through the web version of the account: Go to the official Mi Home website or the Xiaomi developer portal from the browser on your computer or directly to Safari on your iPhone in full version of the site.
Log in with the same account as the app. Find a list of associated devices. Sometimes the device features on the web portal display more technical information than the mobile app. Look for fields related to API or local management.
You can also try using third-party web services that specialize in extraction of tokens. You enter a username and password from a Xiaomi account (use a temporary password!), and the service returns the list of tokens of all devices. Be extremely careful: by transferring account data to third parties, you risk the security of the entire ecosystem of the smart home.
- 🌐 Use the PC version mode in Safari browser.
- 🔑 Change your account password temporarily before using third-party services.
- 🗑️ After receiving the token, be sure to remove the device from the list of trusted on a third-party site.
This method is suitable for those who do not want to install additional applications for traffic analysis, but are willing to compromise on security issues for the sake of convenience.
Solving problems and mistakes
In the process of extracting a token, users often encounter an error of “wrong token” or “Timeout connection.” IP-The address of the device has changed. Make sure your router has a static IP for vacuum cleaner, or check the current address in the router settings.
Another common problem is that the firmware versions are incompatible. If your Xiaomi Vacuum Mop runs on a very old or, conversely, a beta version of the software, the query structure may differ, in which case you can try upgrading the vacuum cleaner firmware through the Mi Home app to a stable version.
If the sniffer doesn't show the token, try clearing the Mi Home app cache or reinstalling it. Sometimes the app caches authorization data and doesn't send a full data packet every time it runs. Complete reinstallation forces the app to go through handshake again.
⚠️ Note: If the Wi-Fi password changes, the token stops working, that's OK. If the network settings change, the device gets a new session token, the key acquisition procedure will have to be repeated.
Also make sure that your iPhone doesn’t activate aggressive ad filters or blockers that can interfere with the sniffer or the Mi Home app itself by blocking the scripts you need.
What to do if the token is not suitable?
Security and storage of access keys
Once you get a token, you take responsibility for its safety, and that key gives you access to the device's management on the local network, and you store the tokens in encrypted form, like password managers like Keychain or specialized applications for storing secrets.
Do not post screenshots of tokens in public sources, chat rooms or forums. Even if you blur some of the characters, a skilled attacker can recover the key or exploit vulnerabilities in the implementation of the protocol.
Check the list of devices that have access to your Xiaomi account regularly.If you notice suspicious activity or unknown devices, immediately change your account password and regenerate tokens for all smart gadgets.
Remember, smart home security starts with protecting your access keys. An internet-enabled robot vacuum cleaner is a potential entry point into your home network, so neglecting basic digital hygiene rules is unacceptable.