Robot vacuum cleaners Xiaomi and Roborock require authorization token to integrate with third-party smart home systems — Home Assistant, Node-RED or IOBroker. On Android, it is simply through traffic sniffing, but iPhone owners have a harder time: Apple blocks low-level access to the network, and the official Mi Home application does not provide the token directly.
In this article, we'll look at current methods for extracting tokens on iOS in 2026, including bypassing restrictions without jailbreaking.
- 🔍 Why the token is needed and where it is used (list of systems)
- 📱 5 Ways to Get a Token on an iPhone (Simple to Complex)
- ⚠️ Risks and how not to block Xiaomi account
- 🔄 Alternatives to the token: cloud API and local protocols
All instructions are tested on iOS 17.4+ with models of vacuum cleaners Xiaomi Mi Robot Vacuum-Mop 2 Pro, Roborock S7 MaxV and DreameBot D10 Plus. If your model is older than 2020, some methods may not work – check compatibility in the table below.
1.What is Xiaomi robot vacuum cleaner token and why you need it
The token is a unique 32-character key that the Mi Home app uses to authenticate requests to Xiaomi servers. Without it, third-party systems will not be able to send commands to the vacuum cleaner via the MiOT protocol (for example, start cleaning on schedule or get a map of the room).
Where the token is applied:
- 🏠 Home Assistant: Integration through the xiaomi_miio component to control the vacuum cleaner in a single smart home panel.
- 📊 Node-RED: Creating automatic scripts (e.g., cleaning when you’re not home).
- 🔌 IOBroker: bundle with other devices (e.g., running a vacuum cleaner when windows are closed).
- 💻 Python scripts: custom solutions for monitoring vacuum cleaner status.
⚠️ Warning: The token is tied to a specific device and account. If you dump the vacuum cleaner to factory settings or change your Mi Home account, the token will become invalid, and Xiaomi can block an account if you suspect automatic token parsing (more than 10 requests per minute).
2 Method 1: Token extraction via HTTP-proxy (without jailbreak)
This is the most reliable method for iOS, without requiring a hacking system, the bottom line: you redirect the traffic of the Mi Home application through a proxy server that intercepts the token from the response of the Xiaomi server.
What you need:
- 📱 iPhone with iOS 15+ (older versions may have certificate issues).
- 💻 Computer (Mac/Windows/Linux) to configure a proxy.
- 🛠 The utility mitmproxy or Charles Proxy.
- 🔌 A vacuum cleaner connected to the same Mi Home account as the iPhone.
Step-by-step:
- Install mitmproxy on your computer: pip install mitmproxy or download Charles Proxy (license required).
- Run a proxy on your computer: mitmweb --mode transparent --showhost (for Charles Proxy, just open the program and click Proxy → Start Proxying).
- On iPhone, go to Settings → Wi-Fi, click on the ⓘ icon next to your network and scroll to Proxy Settings → Manual. Enter IP of your computer and port 8080.
- Install proxy: For mitmproxy: Open the http://mitm.it link on your iPhone and set a profile. For Charles Proxy: Help → SSL Proxying → Install Charles Root Certificate on a Mobile Device.
Mi Home
api.io.mi.com
"token"
🔍 How to find a token in logs:
Look for a server response with a 200 OK code and a body containing:
{
"result": {
"token": "your token here 32_symbol,"
}
}Install mitmproxy/Charles on PC| Connect iPhone and PC to the same network | Set up proxy on iPhone | Set up certificate | Run Mi Home and monitor traffic-->
3 Method 2: Use of alternative applications (Mi Home API)
If a proxy seems complicated, you can use third-party tools that extract the token through an informal API, such as the Mi Home Token Extractor app (available for Android, but there is a workaround for iOS).
The algorithm for iOS:
- Download BlueStacks (Android emulator) to your computer.
- Install Mi Home in the emulator and log in under the same account as on the iPhone.
- Download the Mi Home Token Extractor (APK) and install it in the emulator.
- Launch the application, select your vacuum cleaner from the list - the token will appear on the screen.
4. Method 3: Local token extraction via Mi Home (older models only)
Some Xiaomi vacuum cleaners (released before 2021) support a local protocol that allows you to get a token without a proxy.
- Make sure your vacuum cleaner is connected to the same Wi-Fi network as your iPhone.
- Install the Packet Capture app on your iPhone (available from the App Store).
- Start capturing traffic and open Mi Home.
- Find packages with IP- vacuum cleaner address (usually 192.168.x.x) and 54321 port in the logs.
- In the server response, look for the line "token":
🔍 How to determine if your model supports a local protocol:
| Model vacuum cleaner | Local protocol | Demands a proxy. |
|---|---|---|
| Xiaomi Mi Robot Vacuum 1S | ✅ Yes. | ❌ No. |
| Roborock S5 | ✅ Yes. | ❌ No. |
| Xiaomi Mi Robot Vacuum-Mop 2 Lite | ❌ No. | ✅ Yes. |
| Roborock S7 | ❌ No. | ✅ Yes. |
⚠️ Warning: Starting with the 3.5.8_20210707 firmware, Xiaomi has disabled local access to the token for most models. If your vacuum cleaner was updated after July 2021, this method will not work.
5. Method 4: Changing the account region for simplified token extraction
Xiaomi accounts in Mainland China make it easier to retrieve the token than European/Russian accounts, and if your account is linked to another region, you can temporarily change it:
Instructions:
- In Mi Home, go to Profile → Settings → Country/Region.
- Choose (Mainland China).
- Confirm the change of region (SMS- code may be required).
- Reconnect the vacuum cleaner to your account.
- Repeat token extraction by any of the methods described above.
⚠️ Warning: After region change:
- 📱 The Mi Home app will switch to Chinese (you can return English in the settings).
- 🌍 Some functions (such as voice assistant) may not work well.
- 🔄 To re-engage the region, you have to re-engage all the devices.
💡
Before changing region, back up your device list in Mi Home: Profile → Settings → Backup. This will make it easier to re-assign after returning to the original region.
6. Method 5: Xiaomi Cloud API (alternative to the token)
If you can’t get a token, you can use the Xiaomi cloud API through Mi Cloud Tokens Extractor. This method does not require a device token, but you need to:
- 📧 Login and password from Xiaomi account.
- 🔐 Password B (additional password for API, generated at account.xiaomi.com).
Instructions:
- Go to GitHub repository with a token extraction tool.
- Enter your login, password and Password B in the appropriate fields.
- Click Get Tokens – the system will generate userId, ssecurity and other settings for the cloud API.
- Use this data in Home Assistant or other software instead of a local token.
📌 The benefits of cloud API:
- ✅ Works without being tied to a local network.
- ✅ No traffic interception required.
- ✅ Supports all models of vacuum cleaners.
📌 Disadvantages:
- ❌ Dependence on Xiaomi servers (no management available in case of failures).
- ❌ You need to update Password B every 3 months.
What is Password B and how do you get it?
7. Frequent mistakes and how to avoid them
When you extract a token, you're faced with typical problems, and here's how to solve them:
| Mistake. | Reason. | Decision |
|---|---|---|
| The token is not displayed in proxy logs | Traffic is not redirected through a proxy | Check the proxy settings on the iPhone and the certificate |
| Mi Home app reveals network error | Xiaomi server blocks proxy | Use a VPN or change your account region |
| The token consists of one zero (0000...) | The device is not tied to the account | Reconnect the vacuum cleaner to Mi Home |
| Account blocked after token extraction | Too frequent requests for APIs | Wait 24 hours or contact Xiaomi for support |
⚠️ Warning: If you use two-factor authentication (2FA) in your Xiaomi account, turn it off temporarily before you extract the token. 2FA algorithms may interfere with the proxy by giving you a 401 Unauthorized error.
💡
The most reliable method for iOS is HTTP-proxy (mitmproxy/Charles). Cloud API is suitable if the local token failed to get, but depends on the stability of Xiaomi servers.