Ecosystem users Xiaomi often face the need to obtain a unique identifier for their device for advanced configuration. The standard application Mi Home hides this data from the average user, as it is intended for developers and integration with third-party smart home systems. If you own a device based on Android, the task is simplified thanks to the presence of powerful debugging tools and specialized utilities.
The token is a 32-character string that serves as the encryption key for connecting your smartphone with the robot vacuum cleaner. Without this key, it is impossible to configure local control via Home Assistant, Node-RED or other automation platforms. The process of obtaining data requires care and strict adherence to the algorithm of actions, since the slightest error in the network settings can interrupt the interception of packets.
In this article we will analyze the most relevant and working methods for extracting a token directly from a mobile device. You don't need to connect your phone to your computer or install complex development environments. We will consider both the use of specialized sniffer applications and methods based on analysis of system logs via ADB. The choice of a specific method depends on the version of your operating system and the model of the robot.
Preparing the device and network for data interception
Before starting the procedure, you need to make sure that your mobile device and the robot vacuum cleaner are on the same local network. This is a critical requirement for successful authorization and encryption key exchange. It is recommended to use a Wi-Fi network with a frequency 2.4 GHzas many models of smart technology do not support the range 5 GHz.
Make sure that developer rights are enabled on your smartphone. To do this, go to Settings → About phone and click on the build number seven times. After this, a new section will appear in the settings menu For developerswhere you need to activate USB debugging if you plan to use console methods.
⚠️ Attention: Some providers or router settings can block local traffic between clients (AP Isolation). Make sure this feature is disabled in your router settings, otherwise the application will not be able to see the vacuum cleaner.
It is also worth downloading and installing the application in advance Mi Homeif it is not already installed, and logging into your account. The robot must already be added to the application and work correctly in normal mode. Any changes to the network configuration during the process may require re-binding the device.
☑️ Ready to receive a token
Method of obtaining a token through specialized utilities
The simplest and safest way for users Android is to use applications developed community specifically for token extraction. These apps automatically scan the local network, find devices Xiaomi and request keys from company servers or calculate them locally.
One of the most popular tools is an application Xiaomi Mi Token Extractor or its analogues, available in repositories GitHub and third-party application stores. After launch, the app will prompt you to enter the login and password for your account Mi Cloud. This is necessary to authorize the request to the server where device bindings are stored.
- 📱 Download a reliable token extractor application from a trusted source.
- 🔐 Enter your credentials from your Xiaomi account in the appropriate fields.
- 🔄 Press the scan button and wait until the list of devices appears in your network.
- 📋 Copy the 32-character token corresponding to your vacuum cleaner model.
It is important to note that using third-party applications to enter your account password carries certain risks. Although most of these utilities are open source and verified by the community, there is always the possibility of data leakage. An alternative is a method that does not require entering a password into third-party software, but it is more difficult to implement.
Use a temporary password to log into your account when checking third-party applications, if such a function is supported by the service, or change the main password immediately after receiving the token.
Using ADB debugging to analyze traffic
For advanced users who do not trust third-party applications with their credentials, there is a method of intercepting a token by analyzing system logs using tools ADB (Android Debug Bridge). This method requires connecting a smartphone to a computer or using a terminal directly on the device with root access.
The essence of the method is to launch the application Mi Home in debug mode and filter the system log by keywords. The token is transmitted in clear text or in an easily decodable format at the time the device is synchronized with the server. You will need to install the package platform-tools on your PC or terminal application on your phone.
The process is as follows: connect the device, enable debugging and execute the command to clear the log buffer. Then launch the vacuum cleaner app and perform an action that triggers communication, such as starting cleaning. After that, upload the logs and find a line in them containing the word token.
adb logcat -c
adb logcat | grep -i "token"
In the command output you will see a long string of characters. This is the key you are looking for. The method is the most secure from the point of view of account confidentiality, but requires certain technical skills and understanding of the command line.
What to do if there is no word token in the logs?
Sometimes the token can be encoded or transmitted in the HTTP request headers. Try filtering the logs by the application package name (for example, com.xiaomi.smarthome) or by the IP address of your robot vacuum cleaner. Also check whether the application uses HTTPS pinning, which can hide the contents of packets from a standard logger.
Alternative method through the web interface and sniffing
If mobile methods seem too complex or unreliable, you can use a PC and software traffic sniffers, such as Wireshark or Charles Proxy. This method is universal and works regardless of the phone's operating system, since the analysis takes place on a computer.
To implement this method, you need to set up a proxy server on your computer and specify its parameters in the Wi-Fi settings on your smartphone. You will also need to install a sniffer security certificate on your phone to decrypt HTTPS traffic. After configuration, all application traffic Mi Home will pass through the computer.
| Configuration stage | Action | Required tool |
|---|---|---|
| 1. Software installation | Installing the sniffer on a PC | Wireshark / Charles |
| 2. Network setup | Specifying the PC's IP as a gateway | Android Wi-Fi settings |
| 3. Certificate | Installing a CA certificate | Phone browser |
| 4. Interception | Launch Mi Home and analysis | Sniffer filters |
In the intercepted requests, you need to find a call to the Xiaomi server API. The response body often contains a JSON object with a parameter token. This method gives complete control over the process and allows you to see absolutely all the data exchanged by the application.
⚠️ Attention: Application interfaces and the structure of API requests may change after software updates. If you do not see the token in the usual place in the server response, check the request structure with the current documentation of the developer community.
Decoding the structure of the token and its application
The resulting token is a hexadecimal string 32 characters long. It is unique for each device and does not change during its entire service life, unless you completely reset the robot to factory settings and re-bind it.
Knowledge of the token opens up opportunities for local device management without accessing cloud servers in China or Europe. This significantly reduces delays when sending commands and allows you to control the vacuum cleaner even in the absence of the Internet, while being on the same network with it.
The most common use of the token is integration with the platform Home Assistant. In the configuration file configuration.yaml you must enter the IP address of the device and the received key. After restarting the smart home service, the robot will appear in the list of available devices with all its sensors and functions.
In addition, the token is used in various scripts in the language Python or Node.js to create automation scripts. For example, you can set up cleaning to start when a motion sensor is triggered or a notification is sent about the filling of the dust container directly to the messenger.
The token is a static access key. After receiving it, you get full control over the device on the local network, regardless of the status of the manufacturer’s cloud servers.
Possible problems and ways to solve them
In the process of retrieving a token, users may encounter a number of technical difficulties. Often the problem lies not in the method, but in the features of the network infrastructure or firmware versions. Understanding common errors will help you quickly diagnose and fix problems.
One of the common errors is the "Device not found" message or an empty list of devices in extractor applications. This usually indicates that the phone and the robot are on different subnets or there is isolation between them. Check the VLAN settings on the router and make sure that both devices have IP addresses from the same subnet.
- 🚫 Authorization error: check that the password and account region are entered correctly.
- 📡 No connection with the device: make sure the robot is online and not in sleep mode.
- 🔒 Traffic blocking: antiviruses or firewalls on a PC can block the work of sniffers.
- 📱 Android version: on new OS versions (Android 11+) there may be restrictions on access to Mac addresses and the local network.
If the robot has been reset or reconnected to another network Wi-Fi, the old token will become invalid. In this case, the procedure for obtaining the key will have to be repeated again. It is also worth considering that some new models of vacuum cleaners use advanced encryption protocols, which may be incompatible with older versions of extractor applications.
Is it possible to obtain a token without root access on Android?
Yes, most modern methods, including the use of extractor applications and sniffing through a PC, do not require root access. Root is only necessary in specific cases of deep analysis of system logs without connecting to a computer.
Is it safe to transfer the token to third-party services?
The token gives full control over the device on the local network. It should only be shared with trusted automation systems such as Home Assistant. Do not enter the token on suspicious websites or in unknown applications.
What to do if the token is not suitable for integration?
Make sure that you copy the token without any extra spaces or characters. Check if the robot's IP address on the network has changed. If the device was reconnected, the token may have changed and needs to be obtained again.
Does the account region affect the receipt of the token?
Yes, when using extractor applications, it is important to select the correct server region (China, Europe, Russia, etc.) that matches the settings of your Mi Home account. Otherwise, the server will not return data about the devices.