Xiaomi vacuum cleaner token: where is it, how it looks and why you need it

You bought a Xiaomi robot vacuum cleaner and came across the term “token” (or “token «API-But you don't know what it is or where to look for it? This article will look at everything from the appearance of the token to how it is obtained and used. We will show real screenshots from the Mi Home app, explain why the token is important for integration with Home Assistant, Alice from Yandex or third-party firmware, and warn about the risks of its disclosure.

To be clear, the token is a unique numeral code that identifies your vacuum cleaner in the Xiaomi ecosystem. Without it, it is impossible to connect the device to alternative smart home systems or use advanced features through the use of a new system. API. Externally, it looks like a long string of 32 characters (digits and Latin letters in lower case), for example: a1b2c3d4e5f6...z9y8x7w6v5u4t3s2. But where to find him?

Unlike the serial number (which is usually marked on the case or box), the token cannot be seen physically — it is generated software and stored only in the Xiaomi cloud or locally in the application.

What is Xiaomi vacuum cleaner token and why you need it

A token (or API-token) is a password analog for accessing vacuum cleaner control via MiOT (Mi IoT) protocol.

• 🔄 Integrate vacuum cleaner into smart home systems (Home Assistant, OpenHab, ioBroker).
• 📱 Manage your device through third-party applications (such as Mi Home Alternative or Robot Vac).
• 🛠️ Use advanced functions not available in the official annex (e.g., coordinate zoning).
• 🗣️ Connect voice assistants (Alice, Google Assistant) without region restrictions.

Without a token, you are limited to only the basic features in Mi Home, such as:

• ❌ Set up automatic cleaning on schedule through Home Assistant.
• ❌ Receive notifications about the completion of cleaning in Telegram.
• ❌ Use alternative maps with detailed visualization.

Important: the token is tied to a specific device and Mi Account. If you dump the vacuum cleaner to the factory settings or sell it, the token will become invalid. Xiaomi can also block the token if unauthorized access is suspected (for example, if too many requests to the token are made to the token). API).

What the token looks like: format and examples

Xiaomi vacuum cleaner token is a string of 32 symbols, consisting of Latin letters (a-f) and numbers (0-9). Examples:

• 5f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c
• 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d
• 9876543210abcdef9876543210abcdef

Please note:

• ✅ Symbols are always in lower case (no capital letters).
• ✅ No gaps, dashes or other dividers.
• ✅ It is always 32 characters long – if you have shorter or longer, it is not a token.

Users sometimes confuse the token with other identifiers:

• ❌ Serial number (S/N) — It is written on the body, consists of letters and numbers, but shorter (for example, 123456789ABC).
• ❌ MAC-address XX:XX:XX:XX:XX:XX (for example, 1A:2B:3C:4D:5E:6F).
• ❌ ID Device (did) – a digital identifier in Mi Home (e.g. 12345678).

💡

If you see a string that is 64 characters long, it's not a token, it's an encrypted key (for example, for firmware), and the token is always 32 characters.

Where to find a token in the Mi Home app (official way)

Since 2023, Xiaomi has hidden the tokens from users for security reasons, but they can still be extracted legally through debugging mode in Mi Home.

1. Open Mi Home and go to profile (the human icon in the lower right corner).
2. Press on. ⚙ Settings → About the programme.
3. Tap the app version 10 times in a row until the notification “Developer Mode is on” appears.
4. Return to the main menu, open the device settings (vacuum cleaner) and find a new item Information for developers.
5. In this section, you will have a Token string – copy it.

For iOS, the way is more complicated:

• ✅ Requires jailbreak or special software (for example, MiToken).
• ✅ The alternative is to use MITM-Proxies (e.g. Fiddler) to intercept traffic.

If there is no “Information for Developers” item:

• 🔹 Update Mi Home to the latest version.
• 🔹 Check that the vacuum cleaner is connected to the same account from which you logged in to the application.
• 🔹 For some models (e.g. Xiaomi Mi Robot Vacuum-Mop 2 Pro), the token may be hidden – an alternative method will be required (see next section).

Alternative ways to get a token (if it is not in the Mi Home)

If the official method didn’t work, try these options:

1. via the Mi Account web interface

Go to account.xiaomi.com, log in and:

1. Open the devices. → Your vacuum cleaner.
2. Press Settings → Additionally.
3. V URL-The address of the page will be the did parameter=... — it ID It can be used to generate a token through API.

2. With Python script (for advanced ones)

Install a python-miio library and do:

from miio import Vacuum


vacuum = Vacuum(ip="192.168.1.100", token="YOUR_TOKEN_HERE")




print(vacuum.info())

Replace 192.168.1.100 with IP-address of your vacuum cleaner in the local network.

3. Through parser applications

Applications like Mi Token Extractor (Android) or Token Grabber (Windows) automatically extract the token from Mi Home traffic.

• ⚠️ The possibility of transferring data to third parties.
• ⚠️ Blocking your account with frequent requests.

Risks and security: what happens if the token falls into the wrong hands

The token gives you complete control of your vacuum cleaner, and if it's stolen, the intruder can:

• 🚨 Start/stop cleaning at any time.
• 📍 Get a map of your home (with the layout of walls and furniture).
• 🔊 Turn on voice alerts or sounds.
• 🔄 Update the firmware of the device (potentially “brick” it).

⚠️ Warning: Never publish a token in open sources (forums, GitHub, chats). Use environment variables or encrypted storage to integrate with Home Assistant.

How to defend yourself:

• 🔒 Store the token in a password manager (e.g., KeePass or Bitwarden).
• 🔄 Change your Mi Account password regularly (this will reset all active tokens).
• 🛡️ Set up two-factor authentication in Mi Account.
• 📵 Limit access to the vacuum cleaner on the local network (for example, through router rules).

If you suspect a token leak:

1. Change your password from your Mi Account immediately.
2. Reset the vacuum cleaner to factory settings (Settings) → Reset at Mi Home).
3. Create a new token (it is generated automatically after a reset).

💡

A token is like a key to your apartment, but for a vacuum cleaner. Keep it as carefully as real keys.

Examples of Token Use: From Home Assistant to Alice

Let’s consider the popular scenarios of the use of the token.

1.Integration with Home Assistant

Add to the configuration.yaml file:

vacuum:


- platform: xiaomi_miio




host: 192.168.1.100




token: YOUR_TOKEN_HERE

2. Management through Alice (Yandex)

In the settings of the skill "Xiaomi" in the Yandex application, specify:

• IP-vacuum-dress.
• Token.
• Model of device (e.g, roborock.vacuum.a1).

3. Alternative applications (e.g. Robot Vac)

When you first connect, enter:

• IP-vacuum cleaner address (find in router or via Mi Home).
• Token.
• Region (usually cn for China or ru for Russia)

miio --ip 192.168.1.100 --token YOUR_TOKEN info

If the team returns information about the vacuum cleaner (model, charge, status) – the token works.-->

Frequent mistakes and how to fix them

If the token does not work, check:

⚠️ Attention: Device not found often means that the vacuum cleaner and the device you are sending the command from are on different networks.

If the vacuum cleaner does not respond to commands:

1. Reboot it (hold the power button for 5 seconds).
2. Check if the router firewall is blocking traffic to port 54321 (used for MiOT).
3. Update the vacuum cleaner firmware through Mi Home.

FAQ: Answers to popular questions