How to find out the token of the robot vacuum cleaner Xiaomi through the computer: 3 working ways

Xiaomi’s robot vacuum cleaner token is a unique digital key that allows you to control your device through third-party platforms like Home Assistant, Node-RED or OpenHab. Without it, integration with your smart home is limited to the standard Mi Home app, which deprives users of the flexibility of automation. For example, you can’t run a scheduled cleaning service through Google Assistant or link the vacuum cleaner to motion sensors.

The problem is that Xiaomi doesn’t officially provide the token — it needs to be extracted on its own. Android/iOS, Here's a computer that gives you more options, from network traffic analysis to Python scripting, and in this article, we'll look at three proven methods that are relevant to the Mi Robot Vacuum, Roborock and other Xiaomi-based vacuum cleaners, including newer devices with the protocol. MIOT.

⚠️ Note: Token extraction may violate the terms of Xiaomi’s user agreement. Use methods at your own risk. Do not transfer the token to third parties – this is a threat to the security of your local network.

1.Preparation: What will be needed to extract the token

Before you start, make sure you have everything you need, and without the right preparation, even the most reliable method may not work.

First, check the vacuum cleaner model. Tokens are extracted differently for the base devices. MIOT (Like Roborock. S7 Xiaomi Mi Robot Vacuum-Mop 2 Pro and outdated protocols. You can find out the model on the box, in documents or in the Mi Home app in the Device section. → Settings → About the device.

Second, prepare your computer with one of the operating systems: Windows. 10/11, macOS or Linux (Ubuntu recommended) 20.04+). It should be installed on it:

• 🔧 Python 3.8+ (token-extract script)
• 📡 Wireshark or Fiddler (for traffic analysis)
• 🔑 Postman or Curl (for testing) API-request)
• 📱 Mi Home app (up-to-date version tied to vacuum cleaner)

You'll also need a smartphone with the Mi Home app that's connected to the same network as the vacuum cleaner. If you're using Android, turn on the developer mode and allow debugging. USB (Settings → The phone. → The build number is tap 7 times. iPhone will need a proxy server (for example, Charles Proxy), as Apple blocks interception. HTTPS-traffic.

2. Method 1: Retrieval of the token through Mi Home and Python script

This is the most reliable method for most modern models, and it is based on intercepting authorization data between the Mi Home app and Xiaomi servers.

Step 1: Install Python and the miio library (if not installed). Open the terminal and do:

pip install python-miio

Step. 2: Download the script get_miio_token.py (Or an analogue of it, and save it to a folder that's convenient.

Step. 3: In the file get_miio_token.py Find the username and password lines, enter the username and password from your Xiaomi account (the one the vacuum cleaner is attached to.

Step 4: Run the script with the command:

python get_miio_token.py

If done correctly, a string of 50 characters (digits and Latin letters) will appear in the console, copy it and save it in a safe place. The token is valid indefinitely, but when you dump the vacuum cleaner to the factory settings or re-bind it to another account, it will change.

⚠️ Warning: Do not store the token in open text files or cloud services. If your Xiaomi account is hacked, attackers will be able to control the vacuum cleaner through the local network.

3. Method 2: Token interception through network traffic analysis

This is a more complex technique, but it works even for devices with updated security protocols. HTTPS-Traffic between the Mi Home app and Xiaomi servers.

Step. 1: Install Wireshark (for the purpose of the Windows/macOS/Linux) Fiddler (Windows only) These tools allow you to listen to network packets.

Step 2: On your smartphone, turn on the proxy server:

• 📱 For Android: Go to Settings → Wi-Fi → Additionally. → Proxy server and specify IP your computer with port 8888 (default for Fiddler).
• 🍎 For iPhone: Use Charles Proxy and follow the official instructions.

Step 3: Start Wireshark and start packet capture. filter traffic through the domain api.io.mi.com (this is a Xiaomi IoT server). In Mi Home, open the vacuum cleaner page and perform any action (for example, start cleaning).

Step. 4: Find the captured packages. POST-request /home/rpc/*. The query body will have a token field, which is the key you want:

{


"method": "miIO.info",




"params": {




"did": "123456789",




"token": "YOUR_TOKEN_HERE"




}




}

Method 3: Use HTTP-request MIOT-protocol

For advanced users, there is a way to extract the token through direct HTTP-request API Xiaomi requires a basic knowledge of how to work with REST API and JSON.

Step 1: Get the Device ID (DID) You can find your vacuum cleaner:

• 📄 In the Mi Home app: Device → Settings → About the device → General information (field) ID).
• 🔍 Using Wireshark: in captured packets, look for the option "did".

Step 2: Make an authorization request.

• 🔐 Login and password from Xiaomi account.
• 🌐 User-Agent Mi Home applications (can be copied from Wireshark or used standard: Android-7.1.1-1.0.0-ONEPLUS A3010-136-APP/6.1.103).

Step. 3: Send. POST-request https://account.xiaomi.com/pass/serviceLoginAuth2 body-bound:

{


"clientId": "2882303761517431161",




"packageName": "com.xiaomi.smarthome",




"sign": "YOUR_SIGN_HERE",




"countryCode": "ru",




"qs": "%3FappName%3Dcom.xiaomi.smarthome%26sign%3DYOUR_SIGN_HERE",




"user": "YOUR_PHONE_OR_EMAIL",




"hash": "YOUR_PASSWORD_HASH"




}

The sign field is generated using the Xiaomi algorithm (can be found in the decompiled field). APK Mi Home or use pre-built scripts like com.xiaomi-miio, and after successful authorization, the server will return the serviceToken, which can be used to request the device's token.

Step. 4: Send a second request to https://api.io.mi.com/app/genToken Authorization: Bearer: Authorization Bearer YOUR_SERVICE_TOKEN body-wise:

{


"deviceId": "YOUR_DID",




"passToken": "YOUR_PASS_TOKEN"




}

The answer will be a token field, which is the key you're looking for, which is more complicated than the previous ones, but works for devices with updated security protocols like Roborock. S7 MaxV).

💡

If you don't know the API, Use ready-made tools like Mi Home Token Extractor – they automate the process of authorization and extraction of the token.

5.Token verification and smart home integration

Once you receive the token, you need to check it for performance, and you can use the Python library miio or the Postman tool.

Step 1: Install a miio library (if not installed):

pip install python-miio

Step 2: Connect to the vacuum cleaner using the command:

mirobo --ip PYLESO_IP --token YOUR_TOKEN info

Replace. PYLESO_IP locally IP-vacuum cleaner address (can be found on the router or in Mi Home) and YOUR_TOKEN — If the team returns the device information (model, battery charge, status), the token works.

Step 3: For integration with Home Assistant, add configuration.yaml to:

vacuum:


- platform: xiaomi_miio




host: PYLESO_IP




token: YOUR_TOKEN

Once the Home Assistant is rebooted, the vacuum cleaner will appear in the interface as a controlled device.

• 📅 Set up cleaning on schedule.
• 🔄 Link the vacuum cleaner to other sensors (e.g., start cleaning in the absence of people at home).
• 🗣️ Manage your voice through Google Assistant or Alice.

💡

The token gives access to the local API It's a vacuum cleaner, but it's not a substitute for cloud authorization. VPN port-drift.

6. Frequent errors and their solutions

When you extract a token, users often face problems, and let's look at the most common ones and how to fix them.

Error 1: "Invalid token" or "Unauthorized"

Reasons:

• 🔄 The token is outdated (for example, after dumping the vacuum cleaner).
• 📱 The device is tied to another Xiaomi account.
• 🔐 In the token typo (check the register of symbols).

Solution: Repeat the token extraction process or check the device binding in Mi Home.

Mistake 2: Cannot intercept traffic on Wireshark

Reasons:

• 🛡️ Mi Home uses pinning certificates (interception protection).
• 📵 Proxy is not configured on a smartphone.
• 🔌 Antivirus is blocking Wireshark.

Solution: For Android, try using Packet Capture (an app from the Play Market), for iPhone, Charles Proxy with a certificate installed.

Mistake. 3: Script get_miio_token.py Issuing an authorization error

Reasons:

• 🔑 Incorrect username/password from Xiaomi.
• 🔄 An outdated version of the Miio Library.
• 🌍 The account is linked to another region (e.g. China).

Solution: Update the library (pip install) --upgrade python-miio and check the region of your Mi Home account (Profile) → Chinese accounts may be required VPN.

⚠️ Warning: If the vacuum cleaner has stopped responding to commands after integration, check if the router firewall blocks local requests. IP-vacuum cleaner address in exception or turn off the firewall temporarily.

7.Security: How to Protect a Token from Leakage

The robot vacuum cleaner token is the key to controlling the device on your local network, and leaking it can lead to unauthorized access.

Token storage:

• 🔐 Do not save the token in cloud services (Google Docs, Dropbox).
• 📁 Use encrypted containers (like VeraCrypt) or password managers (KeePass, Bitwarden).
• 📄 If the token is recorded in a configuration file (configuration.yaml), limit access rights: chmod 600 configuration.yaml.

Network security:

• 🌐 Isolate the vacuum cleaner in a separate subnet (VLAN) router.
• 🔒 Disable UPnP on your router to prevent unauthorized access from outside.
• 🔄 Regularly update the firmware of the vacuum cleaner and router.

Activity monitoring:

• 📊 Check your smart home logs for suspicious commands (such as unexpected cleaning starts).
• 🔔 Set up notifications in Home Assistant about new vacuum cleaner connections.

If you suspect that the token has been compromised, immediately:

1. Untie the vacuum cleaner from the Xiaomi account (Mi Home) → Profile → Devices → Delete).
2. Reset the device to factory settings (press the Reset button for 5 seconds).
3. Get a new token and update it in all integrations.

💡

Never share a token in an open source (forum, GitHub-issue). Use a character replacement (e.g., token: "abcde*xyz") to debug it.

FAQ: Answers to Frequent Questions