How to get a token Xiaomi Mi Robot Vacuum Cleaner: all working ways

Xiaomi Mi Robot Vacuum Cleaner has long been an integral part of smart homes, but their full use outside the standard Mi Home app requires knowledge of the device's unique token.This 32-digit key opens up access to the device's smart home. API It's a robot that can be integrated with Home Assistant, Node-RED, or other automation systems. Without a token, you can't send direct commands, get your cleaning status data, or customize complex scenarios.

The problem is that Xiaomi doesn’t provide the token in the open – it needs to be extracted independently.There are several methods, from simple copying through Mi Home (if the device is already tethered) to manually intercepting traffic using the help of a mobile device. MITM-In this article we will discuss all the current methods, including nuances for different models (Mi Robot Vacuum-Mop 2 Pro, S5 Max, STYJ02YM etc.), and also tell how to avoid typical errors when receiving a token.

What is Xiaomi Token and Why You Need It

The token (or device token) is a unique identifier that Xiaomi assigns to each device in the Mi Home ecosystem.

• 🔑 Authentication: Confirms that the request for the device comes from a trusted source (your account or an authorized application).
• 🛡️ Security: protects against unauthorized access to control of the robot (e.g., via a local area network).

Without a token, you're limited by the official app, and with a token, you're open to the horizons.

• 🏠 Integration with Home Assistant, ioBroker, or OpenHAB to create automated scenarios (e.g., running house cleaning when leaving home).
• 📊 Getting Advanced Telemetry: Real-time cleaning maps, battery status, sensor errors.
• 🔧 Using alternative firmware (such as Valetudo) to work without the Xiaomi cloud.

It is important to understand that the token is not static: when you reset the device or reassign it to another account, it changes. Xiaomi periodically updates the protection mechanisms, so some old methods of extracting the token (for example, through miio). extract_tokens) They may stop working on new models.

Method 1: Receiving a token through the Mi Home app (the easiest method)

If your robot vacuum cleaner is already tied to your Mi Home account, you can extract the token without any technical tricks — right from the app. This method works for most models, including the Mi Robot Vacuum-Mop P, S7 and STYTJ01ZHM.

Steps for Android:

1. Open Mi Home and go to your robot vacuum cleaner page.
2. Press three points (⋮) top-right → Settings → General settings.
3. Scroll down and select About program.
4. Tap. 5–7 The same is true of the firmware version (for example, 3.5.9_0043), until the notification appears Additional features unlocked.
5. Go back to General Settings, and there's a new item called Receive a Token (or Device Info). Click on it.
6. Copy the displayed token (32 characters) and do not share it with outsiders!

For iOS: the official Mi Home app doesn't support this method, instead use alternative clients like Mi Home (Poco) or Aqara Home (if the device is compatible), and you can temporarily install Mi Home on your Android emulator (BlueStacks).

Make sure the robot is connected to Wi-Fi|Update the Mi Home app to the latest version|Log in to the same account that the vacuum cleaner is linked to|Turn it off. VPN (It can block access to hidden settings)-->

⚠️ Note: After upgrading to version 6.0, Mi Home+ In this case, use Method 3 (traffic interception) or roll back the application to version 5.9.* APK.

Method 2: Extract a token through a Python script (for power users)

If the hidden mode in Mi Home is not available, the token can be obtained using the miio script. extract_tokens, This method analyzes traffic between the application and Xiaomi servers, and requires basic knowledge of working with Python and other devices. ADB.

Tools required:

• 🐍 Python 3.8+ with established miio and python-miio libraries.
• 📱 Android smartphone with root rights or PC with connected emulator (Genymotion, BlueStacks).
• 🔌 ADB (Android Debug Bridge to intercept traffic.

Step-by-step:

1. Additions: Pip install python-miio
2. Download the script miio_extract_tokens.py GitHub.
3. Connect your smartphone to your PC and start intercepting traffic: adb tcpip 5555 adb connect [IP_your phone]:5555 adb logcat | grep "miio"
4. Open Mi Home and wait for the robot vacuum cleaner to load the data (for example, update the status of the device).
5. Stop log recording (Ctrl)+C) and save the output to the file miio_log.txt.
6. Launch a script to extract the token: python miio_extract_tokens.py miio_log.txt The result will be in the format: Device ID: 123456789 Token: a1b2c3d4e5f6... (32 symbol)

If the script does not find the token, check:

• 🔄 Mi Home Version (should be no newer than 6.0).
• 🌐 Absence VPN or firewall that blocks traffic.
• 📡 Stable connection of the robot to Wi-Fi (token is transmitted only during an active session).

💡

If you don’t have root rights, use an Android emulator with Mi Home pre-installed and set up traffic interception via Fiddler or Charles Proxy.

Method 3: Token interception through MITM-proxy (Charles/Fiddler)

This method is suitable for users who do not have hidden mode in Mi Home, and scripts return errors. HTTPS-Traffic between the application and Xiaomi servers using a proxy server.

What you need:

• 🖥️ PC with Charles Proxy or Fiddler installed.
• 📱 Android/iOS-Mi-home.
• 🔗 Proxy certificate installed on a smartphone (for decoding) HTTPS).

Instructions for Charles Proxy:

1. Install Charles Proxy on PC and enable traffic recording (Proxy) → Start Recording).
2. On your smartphone, connect to the same network as your PC and set up a proxy: On Android: Settings → Wi-Fi → [your network] → Additionally. → Proxy server (manual) → specify IP PC and port 8888. on iOS: Settings → Wi-Fi → (i) → Set up a proxy → Handheld.

• Go to the address. chls.pro/ssl browser-wise.
• Download and install the certificate (on Android, you may need to unlock the installation from unknown sources).
• Open Mi Home, update the robot vacuum cleaner data and stop recording in Charles.
• In the Charles filter, type miio or api.io.mi.com.
• Find a path request. /home/rpc/... — The answer will be a token field: "your token".

⚠️ Attention: Traffic interception through proxy may violate Xiaomi’s privacy policy.Do not use this method for devices not owned by you, and do not distribute the received tokens.

Method 4: Use of alternative applications (Mi Home Mod, Yeti)

If standard methods don't work, you can use modified versions of Mi Home, which display the token in plain view.

• 📱 Mi Home Mod (for Android) – shows the token in device information.
• 🦍 Yeti – an alternative client for managing Xiaomi devices with support for local API.
• 🌐 Mi Home Bind (web service) – allows you to link the device to the account and extract the token through the browser.

Instructions for Mi Home Mod:

1. Download. APK Mi Home Mod with 4PDA (Check the reputation of the source!).
2. Install the app, sign in to your Xiaomi account.
3. Go to the robot vacuum cleaner. → Settings → Device information.
4. Scroll down and the token will be displayed in the Device Token field.

Warnings:

• ⚠️ Modified applications may contain malicious code. Use only verified builds.
• ⚠️ Xiaomi may block an account for using unofficial customers (the risk is minimal, but there is a risk of a default).

Method 5: Obtaining a token for new models (MiOT protocol)

Starting in 2022, Xiaomi introduces a new MiOT (Xiaomi Internet of Things) protocol, which replaces the old miio, in which case the token is extracted differently - through the spec file of the device.

Features of MiOT:

• 🔧 The token is dynamically generated with each connection.
• 🔒 ClientId and Sign Required for Authentication.
• 📡 It only works through the Xiaomi cloud (local management is limited).

How to get data for MiOT:

1. Install the Python-miio version 0.5.8+: pip install --upgrade python-miio
2. Use the script to extract spec: from miio import MiOTDevice device = MiOTDevice("192.168.1.100", "your token_mi_home") spec = device.info() print(spec)
3. In the answer, find the fields “model”, “miotSpec” and “netif” – they will be needed for integration.

Mi Robot Vacuum-Mop 2 Ultra (STYTJ02YM) And the newer token can be hidden even in spec. In this case, use the cloud. API:

from miio import ChuinMiIoProtocol



protocol = ChuinMiIoProtocol(




ip="192.168.1.100",




token="your token,"




model="roborock.vacuum.m1s" # specify the model!




)




device_info = protocol.info()




print(device_info)

💡

For MiOT devices, local management may not be possible without cloud authentication, in which case use Home Assistant with Xiaomi Miio and set up a cloud bridge.

Typical errors and their solutions

When you extract a token, users often face problems, and here are the most common ways to fix them:

Additional advice:

• 🔄 If the robot stopped responding after changing the token, reset through holding the power button for 10 seconds.
• 📡 For models with Dual-Band Wi-Fi (for example, S7 MaxV) connect to 2.4 GHz network – some scripts don’t work with 5 GHz.
• 🔒 If you use Home Assistant, add the token to your config as a token: “your token” in the vacuum section.

Security: How to store and use a token

The device token is like a password from your robot vacuum cleaner, and compromised can lead to:

• 🚪 Unauthorized vacuum cleaner control (on/off, changing settings).
• 📍 Leaking your home’s layout data (if an attacker gains access to cleaning cards).
• 🔄 Blocking Xiaomi device in case of suspected hacking.

Safety regulations:

• 🔐 Store the token in an encrypted file (e.g., KeePass or 1Password).
• 🚫 Do not transfer the token through unsecured channels (messengers, forums).
• 🔄 Regularly update the token (every 3-6 months) through device re-binding.
• 🌐 Limit access to the local network: set up VLAN for IoT devices or use separate Wi-Fi for the robot.

If you suspect that the token has been compromised:

1. Re-link the robot to your Mi Home account immediately (token will reset).
2. Check the logs Home Assistant/other system for suspicious requests.
3. Update the firmware of the robot (sometimes Xiaomi closes vulnerabilities in older versions).

💡

For extra protection, set up fail2ban on the router to block reconnections to IP rogue.

FAQ: Frequent questions about Xiaomi Mi Robot tokens