Xiaomi robot vacuum cleaner token: how to learn and not lose access to smart functions

The access token is a unique password for your Xiaomi robot vacuum cleaner, which opens up advanced management options, from integration with Home Assistant to custom automation scenarios. Without it, many features, such as remote management via MQTT or configuring cleaning areas through third-party applications, are simply not available. But the manufacturer does not provide the token in plain form, and losing it after resetting can turn into a headache.

Complicating the problem, Xiaomi has tightened security since 2020: old methods of obtaining a token (for example, through mi.io without authorization) have stopped working, and new ones require additional steps. In this article, we will discuss current ways for Mi Robot Vacuum-Mop 2 Pro models, Xiaomi Vacuum Cleaner G10 and other popular vacuum cleaners of the brand – including those that run on the new firmware with encryption AES-128.

If you've tried to get a token and you've encountered bugs like Invalid token or Device not found, don't rush to reset your vacuum cleaner settings. You're probably in the wrong region of the Mi Home server or the outdated version of the Python library, and we'll go through these details in detail to avoid the typical mistakes.

What is a robot vacuum cleaner token and why you need it

The token is a 32-digit alphanumeric key that is generated by Xiaomi servers when you first connect your device to your Mi Account. It serves to authenticate requests to the vacuum cleaner API, allowing third-party apps and services to send commands on your behalf. Without the token, you are limited to only the basic functions of the official Mi Home app.

Here’s what you can do with the token:

• 🔧 Integration with Home Assistant or OpenHab to create complex scenarios (e.g., start cleaning when leaving home).
• 📱 Manage via a Telegram bot or voice assistants (Alice, Google Assistant).
• 🗺️ Export of cleaning cards in.svg format for coverage analysis.
• ⚙️ Set up custom cleaning areas via Valetudo or DreameBot.

It is important to understand that the token is tied to a specific account and device. If you sell a vacuum cleaner or dump it to factory settings, the token will become invalid, and Xiaomi can cancel the token if you suspect unauthorized access (for example, if you send requests to the API too often).

Since 2022, some models (such as the Xiaomi Robot Vacuum-Mop 2 Lite) have been using dynamic tokens that are updated every 24 hours, in which case an additional script will be required to automatically update the key to work steadily.

Official method: obtaining a token through Mi Home (for beginners)

The easiest method is to extract the token from the traffic of the official Mi Home app, which is suitable for users who do not want to go into technical details.

• 📱 Smartphone with Mi Home installed (version no lower than 6.0.100).
• 🌐 Access to the Wi-Fi network to which the vacuum cleaner is connected.
• 💻 A computer or second smartphone to intercept traffic.

Step instructions:

1. Install Fiddler or Charles Proxy to intercept HTTP- requests.
2. On your smartphone, configure a proxy server (IP- computer address and port 8888 for Fiddler).
3. Start Mi Home, log in and open the vacuum cleaner management page.
4. In the interceptor program, search for a request to the domain api.io.mi.com with the path /app/genToken - the answer will be the line "token": "your token".

If you use Android, you can do without a computer:

1. Install the Packet Capture app from Google Play.
2. Start capturing traffic and open Mi Home.
3. Find a request to mi.io in the logs - the token will be in the body of the answer.

Attention! If you use an iPhone, you'll need to install a trusted center certificate on the device to intercept traffic. Without that, the Mi Home won't work through a proxy because of Apple's security policy.

Alternative method: extracting the token from the backup of Mi Home

If the traffic interception seems complicated, you can try to extract the token from the backup of the Mi Home settings, which works on Android and does not require root rights, but is only suitable for devices connected to your account.

Steps to extract:

1. Open Mi Home and go to profile → Settings → Data Backup.
2. Create a backup (the file will be saved in the device’s memory).
3. Download the archive to your computer and unpack it. Inside, look for the mihome_backup.json file.
4. Open the file in the text editor and find the "devices" section, which will list all your devices with their tokens.

Example of file structure:

{


"devices": [




{




"did": "123456789",




"token": "a1b2c3d4e5f6...",




"name": "Mi Robot Vacuum",




"model": "roborock.vacuum.a10"




}




]




}

If there is no token in the file, then your version of Mi Home doesn't back it up, so try other methods.

For advanced: obtaining a token through a Python script

This is a method that works for those who are willing to work with the command line, and it's universal and works even for new models of vacuum cleaners with dynamic tokens.

• 🐍 Installed Python 3.8+.
• 📦 Python-miio and click libraries (installed via pip install python-miio click).
• 🔑 Login and password from your Mi Account.

Instructions:

1. Open the terminal and execute the command: Mirobo discover It will find all Xiaomi devices on your local network.
2. Copy the IP- address and the Device ID (did) of your vacuum cleaner.
3. Run the command to receive the token: mirobo --ip ADRESS DETECHNY --token --debug If the device requests authorization, use: mirobo --ip ADRESS DETECHNY login and enter data from Mi Account.

If the script gives an Invalid token error, try to manually specify the server region (for example, for Europe, use --server eu).

Attention! If you use two-factor authentication in Mi Account, you will receive a temporary password in your account settings before running the script, otherwise login will end up with Login failed: -9005 error.

💡

If the script doesn’t find the device, check that the vacuum cleaner and computer are connected to the same Wi-Fi network. Also temporarily disable the firewall or antivirus – they can block multicast requests that mirobo discover uses.

Problems and Errors: What to Do When a Token Fails to Work

Even after you successfully get a token, you may encounter errors, and here are the most common ways to solve them:

• ❌ Invalid token error: Reasons: server region wrong, vacuum cleaner firmware outdated or token reset after the update.Solution: Check the region in Mi Home settings (should match what the script says) and update the vacuum cleaner firmware.
• ❌ Device not found error: Reasons: vacuum cleaner offline or IP- address changed Solution: reboot router and vacuum cleaner, then re-run mirobo discover.
• ❌ Authorization error -5003: Reasons: wrong password or account is linked to another region Solution: change password in Mi Account and repeat authorization with the correct region.

If you get a token to integrate with Home Assistant, but the device doesn’t appear in the system, check:

1. That the configuration file configuration.yaml specifies the correct device_id and token.
2. The Home Assistant settings have the same server region as the Mi Home.
3. Ports 54321 and 80 are not blocked by your router.

Attention! Some models of vacuum cleaners (e.g. Xiaomi Mi Robot Vacuum-Mop 2 Ultra) require additional binding to the account via Mi Home even after receiving the token. If the device does not respond to commands, try reconnecting it in the official app.

How to protect the token and not lose access to the vacuum cleaner

A token is the key to controlling your device, so it needs to be stored securely. Here are some rules:

• 🔐 Don't share a token in open sources (forums, chat rooms). Attackers can gain control of your vacuum cleaner.
• 📝 Save the token in a secure location: a password manager (like KeePass) or an encrypted file.
• 🔄 Regularly update the token for dynamic models (once every 24 hours) via script or Home Assistant.
• 🚫 Don't use the token in untrusted applications. Some "custom" firmware may contain malicious code.

If you are selling a vacuum cleaner, you must:

1. Reset it to factory settings via Settings → Reset to Mi Home.
2. Delete the device from your Mi Account.
3. Remove all saved tokens from your records.

To automatically update the token in Home Assistant, add the following code to configuration.yaml:

vacuum:


- platform: xiaomi_miio




host: DRESS DUST




token: Your Token




name: "Mi Robot Vacuum"




model: roborock.vacuum.a10 #Indicate your model

💡

Dynamic tokens (for 2022+ models) require automatic updates, without which integration with Home Assistant will only work 24 hours, after which a restart will be required.

Comparison of methods of obtaining a token: which one to choose

The choice of method depends on your level of training and the model of the vacuum cleaner.

For most users, the best way to intercept traffic is through Fiddler or Python script. If you don’t want to mess with settings, try the backup method — but be prepared that it may not work.

Attention! For Xiaomi models with v3.5.8_2023 firmware and later (e.g. Xiaomi Vacuum Cleaner G20), standard methods may not work due to the new encryption protocol, in which case use specialized tools like DreameBot or Valetudo-RE.

FAQ: Answers to Frequent Questions