How to find out the token of the vacuum cleaner Xiaomi: official and informal methods

Xiaomi’s robot vacuum cleaners (including Mi Robot, Dreame, Viomi models) require authorization tokens to integrate with third-party smart home systems such as Home Assistant, Node-RED or OpenHab. This unique identifier links the device to your Mi Account and allows you to manage the vacuum cleaner through the API, bypassing the official application. However, the manufacturer does not provide the token in the open form – it needs to be extracted independently.

In this article, you will find 5 current ways to get a token, including the official method through Mi Home/Xiaomi Home, network traffic parsing, using Python scripts and even manual extraction from backup files. We will also analyze the risks of blocking an account using informal methods and provide security recommendations. If you plan to integrate a vacuum cleaner into a smart home system or just want to unlock advanced features, read on.

What is Xiaomi vacuum cleaner token and why you need it

A token (or authentication token) is a unique 32-character key that is generated by Xiaomi servers when you first connect a device to an account.

🔐 Authentication of requests to API vacuum cleaner (for example, to send commands for cleaning or receiving a room map).
🏠 Integration with smart home systems (Home Assistant, ioBroker, Domoticz).
🛠️ Unlock hidden features (such as zoning cleaning in old firmware).
📊 Collecting statistics (working time, covered area, errors) through third-party services.

Without a token, you are limited by the official Mi Home/Xiaomi Home app, which often hides advanced settings or works unstable in some regions. For example, Xiaomi Mi Robot Vacuum-Mop 2 Pro or Dreame D9 models require a token to:

🗺️ Downloading the room map in real time.
🔄 Cleaning schedule settings to within minutes (in the app step - 30 minutes).
🔊 Changes to voice alerts or disabling sounds.

⚠️ Note: Unofficial use of the token may violate Xiaomi’s user agreement, and in rare cases, the account is blocked for “suspicious activity” (for example, too frequent requests to the user). API). We recommend creating a separate account for integrations.

Method 1: Receiving a token through an official application (without rooting)

The safest method is to extract the token from the traffic of the Mi Home or Xiaomi Home app using a proxy server or specialized utilities. You do not need root rights or modification of the vacuum cleaner firmware.

Algorithm of action:

Install an app to intercept traffic on your smartphone, such as the HTTP Toolkit (Android) or Charles Proxy (iOS/Android/PC).
Set up a proxy in your phone (the address and port will indicate the selected utility).
Start Mi Home, log in to your account and connect to the vacuum cleaner.
In the proxy logs, search for a request to the domain api.io.mi.com with the /app/genToken path – the answer will be the line “token”: “your token”.

To simplify the process, you can use the mihome-bin script (available on GitHub):

git clone https://github.com/Maxmudjon/com.xiaomi-miio.git


cd com.xiaomi-miio




python3 -m pip install -r requirements.txt




python3 miio_extract_token.py

Install an application to intercept traffic

Set up a proxy on your phone

Find a request to api.io.mi.com in the logs

Copy token from server response-->

This method works for most models, including:

🤖 Xiaomi Mi Robot Vacuum 1/2/Pro
🧹 Dreame D9, F9, Z10 Pro
🏡 Viomi V2/V3

⚠️ Note: If you use Xiaomi Home (a new app), the token can be transmitted in encrypted form, in which case you will need to additionally remove the encryption key from the token. APK-file.

Method 2: Removing a token from a Mi Home backup

If you have a backup of your Mi Home settings (created through Settings) → Backup, token can be extracted from the mihome.sql file or mihome_backup.db. This method is suitable for users who have already configured sync with the cloud.

Instructions:

Download the backup to your PC (the file will be in.zip or.ab format).
Unpack the archive and find the database file (usually mihome.sql or in the databases folder).
Open the file in the text editor or through SQLite Browser.
Follow the request: SELECT token FROM devices WHERE model LIKE '%vacuum%'; or manually find the line with "token":.

Example of the structure of the mihome.sql file:

Field.	Description	Example of meaning
did	ID of the device	123456789
token	The sought-after token	a1b2c3d4e5f678901234567890abcdef
model	Model vacuum cleaner	roborock.vacuum.a11
name	Name of device	Living room

💡

If the backup is encrypted, try using the Android Backup Extractor utility to extract data.GitHub link: https://github.com/nelenkov/android-backup-extractor

Method 3: Using Python (miio) scripts

The Python-miio library allows not only to manage Xiaomi devices, but also to extract the token if you have logins from Mi Account.

Install the library and execute the script:

pip install python-miio


python -c "from miio import ChuangmiPlug; print(ChuangmiPlug('IP_ vacuum cleaner', 'token').info())""

To automatically receive the token, use the miio-cli script:

miio --discover


miio --ip IP_ vacuum cleaner --token your info token

If the token is unknown, it can be obtained through authorization in Mi Account (login and password required):

from miio import ChuangmiPlug


device = ChuangmiPlug.ip_discover()




print(device.token)

What to do if the script gives an error "Invalid token"

1. Check that the vacuum cleaner is connected to the same network as the PC. 2. Make sure that the router settings turn off AP Isolation. 3. Try to dump the vacuum cleaner to the factory settings and connect again. 4. If you use Xiaomi Home, the token can be tied to the server region (try changing the region in the application to China Mainland).

Method 4: Manual extraction of the token from firmware (for advanced)

This method requires physical access to the vacuum cleaner and ADB or SSH skills. Suitable for Linux-based models (such as the Viomi V3 or Dreame Z10 Pro) where root access is available.

Step-by-step:

Connect to the vacuum cleaner via SSH (usually port 22, login/password: root/123456 or admin/empty).
Run the command to search for a token: cat /mnt/UDISK/config/miio/device.token or grep -r "token" /mnt/UDISK/
If the token is not found, check the configuration files: cat /etc/miio/device.conf

For models on MT7688 (For example, Xiaomi Mi Robot 1S) can be used UART-console:

🔧 Get in touch. TX/RX/GND on the board (usually next to the memory chip).
🖥️ Use PuTTY or screen to connect (speed 115200 bauds).
🔍 Enter the cat command. /proc/mtd search for a configuration section.

⚠️ Warning: The wrong commands in the console can permanently incapacitate the vacuum cleaner. If you are not sure of your actions, use other methods.

Method 5: Buying a token or using public databases

If all of the above methods fail, there are two options:

Buying a token on specialized forums (for example, 4PDA Xiaomi Community, which usually doesn't cost more than 500-1000.₽, There is a risk of a stolen or unworkable key.
Open database searches (such as GitHub Gist or Pastebin) Some users post tokens for testing, but they are often no longer valid or linked to other accounts.

The risks of these methods:

🚫 Account lock (if the token is linked to another user).
🔄 Unstable operation (token can be recalled by Xiaomi server).
🕵️ Data breach (Crookers may request access to your account).

Official Appendix + Proxy

Extract from backup

Python Scripts (Miio)

Manual extraction from firmware

Purchase of token-->

Frequent mistakes and their solutions

When dealing with tokens, users face typical problems, and here are the most common ways to fix them:

Mistake.	Reason.	Decision
Invalid token	Token is false or obsolete	Get a new token or check the server region in Mi Home
Device not found	The vacuum cleaner is not online or blocked	Restart the vacuum cleaner and router, check AP Isolation
Permission denied	No permission to access the API	Use a token with a link to the owner’s account
Too many requests	Exceeded the limit of requests to the API	Wait 1-2 hours or use another account

If the vacuum cleaner has stopped responding after integration:

Turn it off from power for 10-15 seconds.
Reset your network settings in the Mi Home app.
Check if your firewall or antivirus is blocking requests.

💡

If the vacuum cleaner is unstable after receiving the token, go back to the official application and reset to the factory settings, which will remove all third-party integrations and return the device to its original state.

FAQ: Answers to popular questions

Can I use one token for several vacuum cleaners?

No, the token is tied to a specific device (its DID is a unique identifier), and if you have multiple vacuum cleaners, each one needs a token.

What happens if the token falls into the hands of third parties?

The attacker will be able to control your vacuum cleaner (start cleaning, change settings, receive a map of the room) To revoke the token, remove the device from your Mi Home account and connect again.

How to check if the token is valid?

Use the command to get device information: python -m miio --ip IP_vacuumer --token Your Token info If the answer contains data about the model and status – token working.

Can I get a token without connecting to my Mi Account?

Technically, yes, but it requires physical access to the vacuum cleaner and firmware skills, such as the MT7688 models, which store the token in the device's memory and can be retrieved via UART.

Why did the token stop working after the firmware update?

Xiaomi periodically changes the authorization protocols. After the update, you may need to re-receive the token. Check the firmware version in Settings → About the device.