How to find out the token of the robot vacuum cleaner Xiaomi: 4 proven ways

Xiaomi’s robot vacuum cleaners have become an integral part of smart homes, but to fully work with them through third-party applications (such as Home Assistant or Node-RED), a special device token is required.This unique identifier allows you to control the vacuum cleaner through the API, configure automation and integrate it with other systems. Without the token, access to advanced features will be limited to the standard Mi Home application.

The problem is that Xiaomi doesn’t provide the token openly — it needs to be extracted independently. In this article, we’ll look at all the current ways to get a token for 2026 models, including the official method through Mi Home and alternative options for power users, learn how to avoid common mistakes, what tools you will need, and what to do if the token stopped working after a firmware update.

What is the token robot vacuum cleaner Xiaomi and why it is needed

A token (or device token) is a unique 32-digit alphanumeric key that is assigned to each Xiaomi device when first associated with an account, which authenticates requests to the company's API and allows:

• 🔄 Manage the vacuum cleaner through third-party applications (e.g. Home Assistant or ioBroker).
• 📊 Get device status data (charge level, cleaning card, errors).
• ⚙️ Set up automation on schedule or triggers (e.g., starting a house cleaning operation in the absence of a home).
• 🛠️ Bypass the limitations of the standard Mi Home app (e.g., change fan speed or cleaning area).

Without a token, you can only use the vacuum cleaner through an official application where functionality is often cut down. For example, Mi Home may not be able to manually control the cleaning area or adjust complex schedules. The token gives access to the full device API, but it requires certain actions to obtain it.

⚠️ Attention: Token is tied to Xiaomi account and specific device. When you dump a vacuum cleaner or re-link to another account, the token will change, and you will have to re-receive it.

Official method: obtaining a token through Mi Home (for beginners)

The easiest and safest method is to extract the token directly from the Mi Home app, which is suitable for users who don't want to go into technical details.

• 📱 Smartphone with Mi Home app installed (version no lower than 6.0).
• 🔌 Xiaomi robot vacuum cleaner tied to your account.
• 🖥️ Computer installed ADB (Android Debug Bridge or Android Emulator.

Step-by-step:

1. Turn on the smartphone developer mode and activate debugging over USB in the settings.
2. Connect the phone to the computer and confirm access to debugging.
3. Open the command line (or Terminal) macOS/Linux) and execute the command: adb backup -f mi_home_backup.ab -noapk com.xiaomi.smarthome A request to create a backup will appear on the phone - confirm it, but do not set a password.
4. Download the archive. com.xiaomi_mihome And unpack it in a file folder. mi_home_backup.ab.
5. Run the script. mi_home_decrypt.py (for Linux/macOS) or mi_home_decrypt.bat (The token will be extracted into a file. mi_home_data.

In the file you get, find the line "token": "your token." This method works for most models, including the Xiaomi Mi Robot Vacuum-Mop 2 Pro, Mi Robot Vacuum-Mop P and Dreame Bot L10 Pro.

Connection to USB stable|Debugging by USB included|Mi Home app updated|Backup copy created without password-->

Alternative ways to obtain a token

If the official method didn’t work (for example, because of Mi Home updates), alternatives can be used, which take longer, but often are more effective.

1. Through MITM-Proxies (for experienced users)

This means that you can intercept traffic between the Mi Home app and Xiaomi servers.

• 📡 A proxy server (such as Charles Proxy or Fiddler).
• 📱 Rooted Android smartphone or emulator with Xposed Framework.
• 🔧 Certificate for decoding HTTPS-traffic.

Algorithm of action:

1. Install a proxy certificate on your smartphone.
2. Set up traffic interception in Charles Proxy.
3. Open Mi Home and wait until the vacuum cleaner connects to the server.
4. In the proxy logs, find a request to api.io.mi.com with the deviceId option - the token will be in the server's response.

2. via cloud service (for models with Mi Cloud support)

Some vacuum cleaners (e.g. Xiaomi Mi Robot Vacuum-Mop 2 Lite) support cloud management, in which case the token can be obtained through the Mi Cloud API:

1. Sign in to account.xiaomi.com and get a cloud token (not to be confused with device token!).
2. Use Python script to request a list of devices: import requests url = "https://api.io.mi.com/app/home/device_list" headers = {"x-xiaomi-protocal-flag-cli": "PROTOCAL-HTTP2"} data = {"data": '{"getVirtualModel":false,"getHuamiDevices":0,"getSplitDevice":false,"supportSmartHome":true}'} response = requests.post(url, headers=headers, data=data, cookies={"userId": "YOUR_USER_ID", "serviceToken": "YOUR_CLOUD_TOKEN"}) print(response.json())
3. In the answer, find the token field for your vacuum cleaner.

3. Through firmware dump (for advanced)

If the vacuum cleaner supports SSH-access (e.g., embroidered Valetudo), the token can be extracted directly from the file system:

1. Connect to the vacuum cleaner via SSH (logins / passwords for popular models are available on the forums of XDA Developers).
2. Execute the command: cat /mnt/default/miio/miio.conf
3. Find the line token=.

This method is suitable for custom firmware devices, but requires unlocking the bootloader and can result in a loss of warranty.

Official (via ADB)|MITM-proxy|Cloud API|Firmware-dump |I haven't decided-->

Table of compatibility of methods with models of vacuum cleaners

Not all methods work for all devices, and here is the compatibility table for the popular Xiaomi and Dreame models (current for 2026):

If your model is not listed in the table, check it on the 4PDA or GitHub forums, where you often publish up-to-date data on new devices.

Frequent Mistakes and How to Avoid Them

When receiving a token, users often face typical problems, and here are the most common ones and ways to solve them:

• 🔴 Error "Unable to find device" when using ADB: Check if the debugging is included USB and whether drivers are installed for your smartphone. on some devices (for example, Xiaomi with the help of the device). MIUI) You need to allow debugging in security settings.
• 🔴 Token not found in backup: Update the Mi Home app to the latest version and repeat the procedure.If it doesn't work, try an alternative method (MITM cloudy API).
• 🔴 Proxy doesn’t intercept traffic: Make sure your smartphone has a proxy certificate installed and the correct one configured IP/On Android. 10+ Additional adjustments may be required VPN.
• 🔴 Token stopped working after the update: This is normal behavior – Xiaomi sometimes resets tokens when updating the firmware.

⚠️ Note: If you use Home Assistant or similar systems, remember to update it to the configuration file (configuration.yaml) after changing the token.

💡

Before extracting the token, disable two-factor authentication in your Xiaomi account – this will simplify the authorization process in the cloud API.

Security: How to Protect Your Token from Leakage

The device's token is the key to controlling your vacuum cleaner, and if it falls into the wrong hands, attackers can:

• 🏠 Manage the vacuum cleaner remotely (turn on / off cleaning, change settings).
• 📍 Get your home layout data (if the vacuum cleaner builds a map).
• 🔄 Connect your device to your accounts.

To avoid this, follow the rules:

1. Never publish a token in open sources (forums, GitHub, chats).
2. Use the token only on local systems (e.g., Home Assistant on a home server).
3. If you suspect a leak, reset the device to factory settings and get a new token.
4. For cloud integrations (such as IFTTT), use limited tokens with minimal rights.

If you transfer a token to a developer for debugging, generate a temporary account in Mi Home and tie the vacuum cleaner to it. After testing, remove the device from the temporary account.

💡

A token is like a password from your vacuum cleaner. Store it as carefully as your bank card passwords.

FAQ: Answers to Frequent Questions