How to Get a Xiaomi Robot Vacuum Token: 5 Working Ways (Updated 2026)

Xiaomi’s robot vacuum cleaner token is a unique digital key that unlocks advanced device features, such as integration with Home Assistant, Node-RED, third-party apps, or even creating your own automation scripts. Without it, you’re limited to the standard Mi Home functionality, and with it, you control the vacuum cleaner through voice assistants, task schedulers, or custom control panels.

The problem is that Xiaomi doesn't provide the token openly, but it needs to be extracted from app traffic, intercepted through debugging tools, or obtained by decoupling. In this article, we're looking at the current 2026 methods that work for all models: from Mi Robot Vacuum. 1S to DreameBot Z10 We will analyze the methods of different complexity: from simple (via Mi Home) to advanced (using Python and Wireshark).

Important: the token is tied to Xiaomi account and device. If you dump the vacuum cleaner to factory settings or change the region of the account, the token will become invalid. Xiaomi periodically updates security protocols — some methods may stop working. We monitor the relevance and update the instructions.

1.What is a robot vacuum cleaner token and why is it needed

A token (or device token) is a 32-digit alphanumeric code that identifies your device in the Xiaomi ecosystem.It is generated when you first connect a vacuum cleaner to your account and is used to authorize requests to the company's cloud servers. Without a token, third-party systems won’t be able to send commands to a vacuum cleaner, even if they know it. DID (unique identifier of the device).

Examples of use of the token:

• 🏠 Integration with Home Assistant: Vacuum control via dashboards, schedule automation or triggers (e.g., starting cleaning when leaving home).
• 🤖 Python Scripts: Creating custom cleaning algorithms (zonal cleaning, obstacle avoidance, dynamic power change).
• 📱 Alternative apps: Valetudo, DreameHome or Mi Home Lite with advanced features.
• 🔧 Debugging and Repair: Diagnosing Errors Through API, Resetting settings without physical access to the device.

Without a token, you are limited to the official Mi Home app, where functionality is often stripped down (for example, you can’t configure cleaning by coordinates or change the card settings). With a token, you get full control of the device, including access to undocumented commands (for example, turning on the test mode of the engines or resetting the brush counter).

⚠️ Warning: Don't give your token to third parties! With it, you can not only control the vacuum cleaner, but also access other devices in your Xiaomi account if they use the same server region. Store the token in a secure place (for example, in a password manager).

2.Preparation: What to do before extracting the token

Before proceeding to receive the token, follow the mandatory steps:

Make sure the vacuum cleaner is connected to Wi-Fi (2.4 GHz)

Update the Mi Home app to the latest version

Put the debugging on. USB on a smartphone (for methods with traffic interception)

Create a backup of vacuum cleaner settings in Mi Home

Check that your Xiaomi account is linked to the Mainland China region (for some methods)

-->

The most reliable way to use an account is to use a Mainland China account, because Xiaomi shares servers for different regions, and tokens received in the European or Russian version of Mi Home may not work with third-party services.

1. Open Mi Home → tap on the avatar → Account settings.
2. Select Country/Region → Mainland China (China).
3. Leave the account and log in again.
4. Connect the vacuum cleaner to the account again (it will appear in the list of devices).

If you don’t want to change the region, you can still get the token, but some commands are available. API They may not work well, but also note that for methods that intercept traffic (HTTP-Server or Fiddler requires root access on Android or jailbreak on iOS, or emulator use.

Mi Robot Vacuum 1/1S/1C

Mi Robot Vacuum-Mop 2/2S/2 Pro

DreameBot (D9, Z10, L10 etc.)

Viomi (SE, V3, etc.)

Other (specify in the comments)

-->

3. Method 1: Receiving a token through Mi Home (the easiest)

This method works for most models and does not require technical skills, the point is to pull the token from the cache of the Mi Home application using a special script.

Steps for Android:

1. Download and install the Mi Home Backup app (unofficial but verified by the community).
2. Open Mi Home Backup and click Login with Xiaomi Account.
3. Enter your username/password from your Xiaomi account (the region must be Mainland China).
4. After authorization, select your vacuum cleaner in the list of devices.
5. Click Backup Device Data – the token will appear in the Token field.

Steps for iOS:

On the iPhone, the process is more complicated because of the system limitations.

1. Install Mi Home on a Mac OS via an emulator (e.g. Xcode) + iPadian).
2. Use mitmproxy or Charles Proxy to intercept traffic (instructions below in method 4).
3. Or use a Python script that emulates authorization.

If Mi Home Backup doesn’t show the token, try:

• 🔄 Restart the application and repeat authorization.
• 📱 Remove the Mi Home cache in the phone settings.
• 🌐 Change your account region to Mainland China (if you haven’t already done so).

💡

If you have two-factor authentication in your Xiaomi account, temporarily disable it before using Mi Home Backup, this will eliminate authorization errors.

4. Method 2: Intercepting a token through HTTP-server (for advanced servers)

This method requires Python and terminal skills, but it gives you 100% results, and we're going to emulate the Xiaomi server so that the Mi Home app sends a token to it.

What you need:

• 💻 Computer with Python 3.8+ and the mitmproxy library.
• 📱 Smartphone with Mi Home and Wi-Fi access.
• 🔌 A vacuum cleaner connected to the same Wi-Fi as a computer.

Step-by-step:

1. Install mitmproxy via the terminal: pip install mitmproxy
2. Launch a proxy server: mitmweb --mode transparent --showhost (The web interface will open on http://127.0.0.1:8081)
3. On your smartphone, connect to Wi-Fi, where mitmproxy works, and configure a proxy: IP your computer (to know via ipconfig or ifconfig) port: 8080.

mitmproxy

http://mitm.it

Mi Home

mitmproxy

api.io.mi.com

/app/genNonce

/app/login

"ssecurity"

Example of a server response with a token:

{


"code": 0,




"message": "ok",




"result": {




"ssecurity": "5f4dcc3b5aa765d61d8327deb882cf99," // ← This is a token




"location": "CN",




"userId": 123456789




}




}

⚠️ Note: If you are using Mi Home versions older than 6.0.100, Xiaomi may block uncertified proxies, in which case try to roll back to an older version of the app (e.g. 5.9.54) or use the method with Packet Capture (described below).

5. Method 3: Using Packet Capture (without root)

If previous methods have failed, try to intercept the token using the Packet Capture app (available for Android).This method does not require root rights, but caution is needed - not all versions of the Mi Home are compatible.

Instructions:

1. Download Packet Capture from Google Play.
2. Open the app, press Start Capture and select HTTP/HTTPS.
3. Return to Mi Home, log in to your account and wait for the device list to load.
4. Stop capturing traffic in Packet Capture and search for a request to api.io.mi.com.
5. In the server response, look for the “token” or “ssecurity” field.

6. Method 4: Removing tokens from Mi Home files (for Android with root)

If your phone has root access, the token can be extracted directly from Mi Home files, a method that is robust but requires caution – incorrect actions can cause the app to crash.

Step-by-step:

1. Install a file manager with root support (such as Root Explorer or FX File Explorer).
2. Cross the path: /data/data/com.xiaomi.smarthome/databases Look for the file. miio_device.db or com.xiaomi.smarthome_preferences.xml.
3. Open the file. miio_device.db In the text editor and find the line with your vacuum cleaner (ID device).
4. If there is no file, check the folder: /data/data/com.xiaomi.smarthome/shared_prefs There may be a file here. device_token.xml informatively.

Example of contents miio_device.db:

⚠️ Note: Modifying files in the folder /data/data/ You can also back up the file before editing, and don’t transfer the token through unsecured channels (such as open chats or forums) – it can be used to control your vacuum cleaner!

Method 5: Alternative methods (for specific cases)

If none of the above methods worked, try these options:

• 🔧 Through Mi Home for PC: Install the desktop version of Mi Home and use Fiddler or Wireshark to intercept traffic. api.io.mi.com/miot-spec/v2/instance.
• 🤖 For Dreame robots: In the DreameHome app, the token is stored in the open. ADB for retrieval: adb shell "cat" /data/data/com.dreame.vacuum/files/device_token.txt"
• 📡 Mi Cloud Tokens Extractor: The online service mi.tokens.extractor (unofficial) allows you to get a token by login / password from your Xiaomi account.Risk! Enter data only if you trust the resource.
• 🔄 Reset and Re-Association: If the vacuum cleaner was previously linked to another account, reset through a button on the case (press Reset for 5 seconds), then re-assign and re-extract the token.

For Viomi models (e.g. Viomi) V3) The token can be obtained through the Viomi Home app using the same method as mitmproxy. The main thing is to make sure that the account region is set in China, otherwise, the user can use the same method. API-The requests will go to other servers.

vacuum:


- platform: xiaomi_miio




host: IP_DUST




token: Your Token

After the Home Assistant reboot, the vacuum cleaner will appear in the interface as a controlled device.-->

8. Frequent errors and their solutions

When you extract a token, you're faced with typical problems, and here's how to solve them:

If you get an Invalid token error when using the token in Home Assistant or other systems, make sure that:

• 🔗 Token copied without spaces and unnecessary symbols.
• 🌍 The account region matches the server region in the integration settings.
• 🔄 You didn’t dump the vacuum after receiving the token (this dumps the token!).

FAQ: Answers to Frequent Questions