How to find out the token robot vacuum cleaner Xiaomi: all working ways in 2026

Xiaomi’s robot vacuum cleaners (including Mi Robot Vacuum, Dreame, Viomi models) require a special access token to integrate with third-party smart home systems – Home Assistant, Node-RED, OpenHab or custom scripts. This token acts as a “password” to authorize the device in the Mi Home cloud, but the manufacturer does not provide it to users directly. Without the token, you will not be able to control the vacuum cleaner through the API, automate cleaning on a schedule or link it to other devices.

The problem is that Xiaomi regularly tightens its protections: old methods of token extraction (via mitmproxy or APK decompilation) stop working, and new ones require current knowledge. In this article, we will examine all working ways to get a token in 2026, from official (via the Mi Home app) to alternative (using Python scripts and tools like Token Extractor).

What is the token robot vacuum cleaner Xiaomi and why it is needed

The token is a unique 32-digit alphanumeric key that is generated by Xiaomi servers when the device is first connected to a Mi Account.

  • 🔐 Authorization API-Mi Home cloud requests (e.g., start, pause commands, set_mode).
  • 🤖 Integration with smart home systems: without a token Home Assistant will not be able to “see” the vacuum cleaner.
  • 📊 Telemetry: data on battery charge, cleaning area, errors (codes) error_10, error_12 etc.).
  • ⚙️ Custom scenario settings: for example, starting cleaning when leaving home (via geo-fences).

It is important to understand that the token is tied to a specific device and account. If you dump the vacuum cleaner to the factory settings or reconnect it to another Mi Account, the old token will stop working, and Xiaomi can cancel the token if you suspect a hack (for example, if too many requests are sent from one IP).

📊 What kind of smart home system do you use?
Home Assistant
Google Home
Apple HomeKit
Node-RED
Other/no

Official method: obtaining a token through Mi Home (without root)

The most reliable and legal method is to extract the token directly from the Mi Home app using built-in tools, which works for most models (Mi Robot Vacuum-Mop 2 Pro, Dreame D9, Viomi V3, etc.), but requires an Android device (on iOS, this method is not available due to Apple’s restrictions).

Instructions:

  1. Install the latest version of Mi Home from Google Play.
  2. Log in to your Mi Account and make sure the vacuum cleaner is connected to it.
  3. Download Packet Capture for Mi Home (or HTTP Toolkit).
  4. Turn on Android Developer Mode: Go to Settings → About Phone → Build Number (click 7 times).
  5. In the developer settings, activate Debugging over USB and Do not turn off the screen.
  6. Launch Packet Capture, select the Mi Home app and start recording traffic.
  7. In Mi Home, open your vacuum cleaner page and update the data (pull the screen down).
  8. Stop recording in Packet Capture and find a request in the logs to the domain api.io.mi.com with the deviceId parameter.
  9. The server response will be the line "token": "your token here" - copy it.

The latest update to Mi Home has been installed

The vacuum cleaner is connected to the Mi Account

Developer mode on Android is enabled

Packet Capture or HTTP Toolkit

VPN/proxy disabled (can block traffic)

-->

⚠️ Note: If there is no token in the logs, check:

  • 🔄 Update Mi Home to the latest version (older versions may not send the token in plaintext).
  • 🌐 Make sure your region in Mi Home matches your account region (e.g. Mainland China or Russia).
  • 📵 Disable Two-Factor Authentication for the time of token extraction (it can block requests).

Alternative methods: Python scripts and Token Extractor

If the official method didn't work, you can use third-party tools. Here are two proven options.

Method 1: Script miio-cli (for PC)

The miio-cli utility allows you to get a token through the command line if you have one. IP-Address of vacuum cleaner and login from Mi Account.

Instructions for Windows/Linux:

  1. Install Python 3.8+ and python-miio: pip install python-miio
  2. Download the script miio_extractor.py.
  3. Run it with the settings: Python miio_extractor.py --user your e-mail@mail.com --password password --country cn (replace cn with ru if your account is linked to Russia).
  4. In the conclusion, find the Token line: your token.
What to do if the script gives an error "Invalid credentials"
Check that: 1. You are using the correct region (--country). 2. Password is entered without spaces and special characters (try changing it to simple temporarily). 3. Two-factor authentication is disabled in the Mi Account settings. 4. Your IP is not blocked by Xiaomi (try using a VPN with Chinese IP).

Method 2: Token Extractor for Android (without root)

The Token Extractor app automates the process of extracting a token from Mi Home:

  1. Download APK with 4PDA (registration required).
  2. Install the application (allow installation from unknown sources).
  3. Start Token Extractor and log in to your Mi Account.
  4. Click Get Tokens – in 10–30 seconds, a list of devices with tokens will appear.

⚠️ Note: Some antiviruses (e.g. Kaspersky) may block Token Extractor as “potentially dangerous software.” This is a false positive, but download APK only from verified sources (e.g, 4PDA or GitHub).

Compatibility table: methods for different models of vacuum cleaners

Not all methods work equally well for different devices, and here are the current data for 2026:

Model vacuum cleanerPacket Capture (Android)miio-cli (Python)Token ExtractorNotes
Mi Robot Vacuum-Mop 2 Pro✅ Yes.✅ Yes.✅ Yes.China Mainland is required in Mi Home.
Dreame D9 / D10✅ Yes.⚠️ Partially.✅ Yes.For Dreame, use --country cn in mio-cli.
Viomi V3 / SE❌ No.✅ Yes.✅ Yes.Packet Capture is not working because of traffic encryption.
Mi Robot Vacuum E10✅ Yes.✅ Yes.❌ No.The token is valid for 30 days only (requires an update).
Xiaomi Mop 2 Ultra✅ Yes.✅ Yes.✅ Yes.It supports new MiOT protocols.

💡

If your model is not listed in the table, try the miio-cli method with the parameter. --debug — It will show detailed error logs that will help diagnose the problem.

Safety: How not to lose access to the vacuum cleaner

A token is like a key to your device, and if it's taken over by a third party, it can:

  • 🏠 Control the vacuum cleaner remotely (on/off, change settings).
  • 📍 Get your home layout data (cleanup maps contain coordinates of walls and furniture).
  • 🔄 Unconnect the device from your account (via API-request unbind).

To protect yourself:

  1. Never publish a token in open repositories (e.g. GitHub), forums, or comments.
  2. Use the token only on local systems (for example, Home Assistant on your server), not in cloud services.
  3. Change the password from Mi Account after extracting the token (in case of data leakage).
  4. Restrict access to the token in the settings Home Assistant: Vacuum: - Platform: xiaomi_miio host: 192.168.1.100 token:!secret xiaomi_token # Store the token in a separate secret.yaml file

⚠️ Warning: If you suspect that the token has been compromised (for example, the vacuum cleaner has started to behave strangely), immediately untie it from your account:

  1. Open Mi Home → go to the vacuum cleaner page.
  2. Press. ⋮ → Settings → Untie the device.
  3. Connect the vacuum cleaner again - a new token will be generated.

Frequent mistakes and their solutions

When you extract a token, you have a typical problem, and we're going to look at some of the most common ones.

Error 1: "Invalid token" or "Device not found"

Causes and solutions:

  • 🔄 Token is outdated: some models (Dreame Bot) W10, Mi Robot E10) Repeat the procedure for obtaining it every 30 to 90 days.
  • 🌍 Incorrect region: if your account is registered in Russia (ru), and you use --country cn in miio-cli, request will be rejected. Check the region in Mi Home (Profile) → Region).
  • 📵 The vacuum cleaner is disconnected from Wi-Fi: the token only works when the network is active. Make sure the device is online (the Wi-Fi indicator burns blue).

Error 2: Unable to fetch token in Packet Capture

Possible causes:

  • 📱 Old Mi Home: Update the app to the latest version on Google Play.
  • 🛡️ Traffic blocking: turn off VPN, Proxy or antivirus (e.g., Avast may block Packet Capture).
  • 🔧 Incorrect settings Proxy: in HTTP Toolkit make sure that you select the Android Intercept mode and have a certificate installed.
How to check if the token is alive
Send a test request via miio-cli: miio --debug call 192.168.1.100 miIO.info If the answer contains "result": "ok" - the token is valid. If "error" is a wrong token or an offline device.

Error 3: "Device is bound to another account"

This error occurs if:

  • 🔄 You dropped the vacuum cleaner to the factory settings, but did not untie it from the old account.
  • 👥 The device was donated/sold and the previous owner did not remove it from his Mi Account.

Decision:

  1. Ask the previous owner to untie the vacuum cleaner at Mi Home.
  2. If you cannot contact us, contact Xiaomi with proof of purchase (check, box with serial number).
Can I get a token on an iPhone (iOS)?
No, on iOS, it is impossible to intercept Mi Home traffic without jailbreaking due to Apple restrictions. Alternatives: Use an Android emulator (for example, BlueStacks) with Mi Home and Packet Capture installed. Take a temporary Android device from friends or buy a used smartphone for 2–3 thousand rubles. Try the miio-cli method on a PC (requires a username / password from Mi Account).
How often should the token be updated?
Depending on the model: Old models (Mi Robot 1S, Dreame D9): the token is unlimited unless you dump the device. New models (Mi Robot Vacuum-Mop 2 Pro, Xiaomi Mop 2 Ultra): the token can be reset every 30–90 days (re-extracted required). Devices for the Chinese market (cn region): the token can be blocked when you frequently request from abroad. To check the relevance of the token, send a test request (see spoiler above).
Can I use one token for several vacuum cleaners?
No, the token is unique to each device. If you have two vacuum cleaners (like the Mi Robot Vacuum and Dreame Bot), each needs a token. Exception: if you have a multi-zone vacuum cleaner (like the DreameBot X30 Ultra with two docking stations), it can use one token for all modules.
What if Xiaomi has blocked my account after token extraction?
Blocking occurs when: Too frequent requests to the API (more than 100 per minute); using a token from unusual IP (for example, servers in Europe for a Chinese account); trying to match passwords through miio-cli. Solution: Wait 24 hours - temporary blocking is usually removed automatically. Write in support of Xiaomi (in English or Chinese) explaining that "you are a developer and testing integration." Create a new Mi Account and reconfigure the vacuum cleaner (re the old device from the blocked account).
How to protect the token when using Home Assistant?
Follow these rules: 🔐 Store the token in secrets.yaml, not mainly configuration.yaml: #secrets.yaml xiaomi_token: "your token here" 🌐 Restrict access to Home Assistant IP (in configuration.yaml): http: ip_ban_enabled: true login_attempts_threshold: 3 🔄 Regularly update the Home Assistant and plugin xiaomi_miio (Outdated versions may contain vulnerabilities). 📵 Disable Remote Access to Home Assistant via Nabu Casa or DuckDNS if you are not using it.

💡

If you plan to use the token in cloud services (for example, to manage a vacuum cleaner through a Telegram bot), create a separate Mi Account specifically for this.