How to find out the Xiaomi Mi Robot Vacuum 2021 token: step-by-step instructions

Owners of modern cleaning systems often face the need to integrate their device into smart home ecosystems beyond the standard application. For models released in 2021, such as the Xiaomi Mi Robot Vacuum Mop 2 or Roborock S7 (powered by Xiaomi’s platform), a unique security identifier becomes a critical parameter. This key, known as a token, is necessary for local device management through the Miio protocol, which allows for advanced features in Home Assistant, Node-RED or other automation platforms.

Receiving this key is not always an obvious task, as the manufacturer deliberately hides it in the deep layers of the application’s system files for security. Without this 32-character hexadecimal key, you will not be able to send commands directly to the device over the local network. In this article, we will discuss current methods for token extraction for devices of the 2021 model year, which may differ from the old schemes due to updates to encryption protocols.

⚠️ Note: The process of obtaining a token often requires root rights to Android or the use of emulators with interception of traffic.

There are several proven ways to extract the treasured string of characters. The specific method depends on your technical background, the presence of the computer and the operating system you use as the main tool, the most popular are the method of intercepting traffic through Charles Proxy, using modified versions of the Mi Home app with logging enabled, and direct extraction from the Android database.

Environment preparation and necessary tools

Before you start to extract a token, you need to prepare software. If you plan to use the method of traffic sniffering, you will need a computer (Windows, macOS or Linux) and a smartphone connected to the same Wi-Fi network. The main tool here is Charles Proxy, or its free version, mitmproxy, which allows you to intercept and analyze. HTTPS-The queries your device sends to Xiaomi servers.

The second, easier for beginners way, requires the installation of a special plugin or modified APK-The official version of the application from Google Play or AppStore does not allow you to view the tokens of connected devices in an open form. You will have to download a dedicated developer version or use plugins implemented through Taichi or Xposed Framework if you have root rights.

• 📱 Android-based smartphone (for methods with traffic interception or root access) or iOS (only for the method with a computer and iTunes).
• 💻 Personal computer for installation of proxy server and analysis of data packets.
• 📡 Stable connection to the Wi-Fi network to which the robot vacuum cleaner is connected.
• 🔐 Mi Account to which the device is linked (a token is generated individually for each pair of account-device).

It is important to understand that the token is not only associated with the serial number of the device, but also with the user account. If you change the region in the application or log in under another login, you will have to repeat the procedure again.

The method of intercepting traffic through Charles Proxy

This method is considered the “gold standard” and works for almost all models of 2021, including the Xiaomi Vacuum Mop 2 Pro. The essence of the method is to get your mobile device to send all Internet traffic through the computer where Charles Proxy is installed. This will allow you to see the content of requests that are usually hidden by encryption. SSL.

First, install Charles Proxy on your computer and start it. → Proxy Settings write down the port (default 8888). SSL-On Android, it's done through Wi-Fi settings (manual proxy settings), on iOS, through the configuration profile. Once the certificate is installed and the proxy is enabled, all smartphone traffic will go through the computer.

Now, open the Mi Home app on your smartphone. You need to call a device status update. Pull down the device list for an update or log in to the robot interface and click on the status update button. At that point, a lot of queries will appear in the Charles Proxy window. You need to find a request that contains the word device or bind in the address and see its contents in the Contents tab.

In the server response (Response), look for the token field. It will look like a long string of 32 characters (digits and letters a-f). Copy it. If you see a lot of queries, focus on the domain api.io.mi.com or smart home. Often the token is transmitted when you first load a list of devices or log in to a device card.

Use of plugins and modified applications

If messing with proxy and certificates seems too complicated, you can use ready-made solutions created by enthusiasts. For Android users, there are plugins that are embedded in the process of the official Mi Home application and display the token directly on the screen or save it to the log. One of the most popular solutions is a plugin for Taichi or VirtualXposed.

This method does not require root rights if you use a virtual environment. You install Taichi, add the Mi Home application and the necessary plugin (for example, "Mi Home Token Plugin"). Once you run the application through Taichi, when you connect to the robot, the plugin will intercept the server's response and show a pop-up notification with the token.

⚠️ Attention: Use of modified APK-Use only trusted repositories such as GitHub official integration developers, and do not apply these methods to major accounts with critical data.

For iOS users, the situation is more complicated because of the system's closedness. The only way to work without jailbreaking is to use the backup method. You back up your iPhone to your computer, then use the iMazing utility or iPhone Backup Extractor to extract the files of the Mi Home application. Inside the MiHome.sqlite database in the Device table, you can often find the token field.

However, in the latest iOS and Xiaomi apps, this method may not work as data is encrypted or transferred to a secure key store. Therefore, for iPhone owners, the Charles Proxy method remains the most reliable, despite its time-consuming.

Receiving a token through ADB and system files

For advanced Android users with access to ADB (Android Debug Bridge), there is a direct way to get a token from the application’s system files, a method that requires that the phone be enabled with USB debugging and, in some cases, root rights, although older versions of Android could pull data out without it through a backup.

The essence of the method is to extract the SharedPreferences of the Mi Home application: /data/data/com.xiaomi.smarthome/shared_prefs/miio_local_device.xml Or something like that. XML-The file stores data about connected devices, including their tokens.

adb pull /data/data/com.xiaomi.smarthome/shared_prefs/miio_local_device.xml./

If you don’t have root rights, but you can make a full backup of an application through ADB (adb backup command), you can unpack the.ab archive and find the desired XML there. However, starting with Android 9 and up, the ability to create full backups through ADB is often blocked by manufacturers, making this method less versatile than intercepting traffic.

It's worth noting that for 2021 models, the file structure may have changed. If you don't find a token in a familiar place, try searching in the files folder inside the application directory or in the logs if debugging is enabled. Look for lines containing your vacuum cleaner's did (Device ID), and the token you're looking for is usually next to them.

Table of conformity of models and features of tokens

Various models of robot vacuum cleaners released in 2021 under the Xiaomi brand or sub-brands (Roborock, Dreame, Viomi) may have nuances in the generation and storage of tokens. Below is a table that helps identify features for popular devices.

Note that Viomi Home devices sometimes use different authorization methods than standard ones. They may require a separate plugin or use specialized scripts in Python that emulate the Viomi login. The token in such cases can also often be mined through sniffing, but the server address will be different (for example, api.viomi.com).

If your vacuum cleaner was purchased in China (Chinese version), but you use it with a European account, you may have trouble displaying the token. In this case, try temporarily changing the region in the Mi Home app to China, re-tether the device and try to intercept the token again.

Decision and possible errors

Users often face typical problems in obtaining a token, and one of the most common is the SSL error in the Charles app. If you see red icons or an app says that the connection is not secure, then you have installed the certificate incorrectly. On Android 7 and above, installing user certificates requires additional manipulation or root rights, since the system by default does not trust such certificates.

Another common mistake is getting a token that is not 32 characters long, and that's a signal that you've copied the wrong parameter. The Miio token is always a string of 32 hexadecimal characters. If there are more or fewer characters, or there are special characters in the string, it's not a token. Also make sure that you copy the token exactly for the device you need by checking MAC-address ID.

• 🚫 Connection Error: If the robot does not respond to commands after entering the token, check if it has changed IP-Device address. Local control is desirable IP vacuum cleaner in router settings (DHCP Reservation).
• 🔄 Changing Wi-Fi Password: When changing the password from the home network, the device token may be reset or become invalid.
• 🌍 Blocking by region: Some Xiaomi servers block frequent requests for a token from one IP. Make pauses between attempts.

⚠️ Warning: If you reset your Wi-Fi settings on the robot vacuum cleaner itself (clamping the reset buttons), the old token will stop working.

Integration and use of the received token

Once the 32-character key is successfully extracted, it is put into practice, most often in the Home Assistant integration settings, and the configuration file configuration.yaml adds a record with the following keys. IP-This allows you to operate a vacuum cleaner without a cloud, run a cleaning schedule based on the weather, or receive notifications about filling a container directly from Telegram.

💡

Keep the token safe! Write it down in a notebook or password manager. If you lose the token and the app gets updated or the phone is changed, the procedure will have to be re-run, which can be difficult without a computer at hand.

You can also use the command line for local management by installing miio (part of the python-miio project) to send commands directly, for example, a command to run a cleanup would look like a vacuum.start call through CLI.

miio --ip 192.168.1.50 --token your vacuum start

Using the token opens up access to hidden features that are not available in the official app. You can configure zone cleaning to coordinate accuracy, change the speed of the brush outside of the standard modes, or even flash the device with alternative firmware (Valetudo), completely disconnecting it from Xiaomi servers and making it completely local.

Questions and Answers (FAQ)

💡

Getting a token is a one-off procedure that gives you complete control over a smart device, allowing you to integrate it into a single smart home system and dependency on the manufacturer’s cloud servers.