diff --git a/homeassistant/bootstrap.py b/homeassistant/bootstrap.py
index 5c85267ca44795..41fa61964de817 100644
--- a/homeassistant/bootstrap.py
+++ b/homeassistant/bootstrap.py
@@ -87,9 +87,11 @@ async def async_from_config_dict(config: Dict[str, Any],
                              log_no_color)
 
     core_config = config.get(core.DOMAIN, {})
+    has_api_password = bool((config.get('http') or {}).get('api_password'))
 
     try:
-        await conf_util.async_process_ha_core_config(hass, core_config)
+        await conf_util.async_process_ha_core_config(
+            hass, core_config, has_api_password)
     except vol.Invalid as ex:
         conf_util.async_log_exception(ex, 'homeassistant', core_config, hass)
         return None
diff --git a/homeassistant/config.py b/homeassistant/config.py
index cc4eef3f97e29d..1c47a5e036c993 100644
--- a/homeassistant/config.py
+++ b/homeassistant/config.py
@@ -407,7 +407,8 @@ def _format_config_error(ex: vol.Invalid, domain: str, config: Dict) -> str:
 
 
 async def async_process_ha_core_config(
-        hass: HomeAssistant, config: Dict) -> None:
+        hass: HomeAssistant, config: Dict,
+        has_api_password: bool = False) -> None:
     """Process the [homeassistant] section from the configuration.
 
     This method is a coroutine.
@@ -416,9 +417,18 @@ async def async_process_ha_core_config(
 
     # Only load auth during startup.
     if not hasattr(hass, 'auth'):
+        auth_conf = config.get(CONF_AUTH_PROVIDERS)
+
+        if auth_conf is None:
+            auth_conf = [
+                {'type': 'homeassistant'}
+            ]
+            if has_api_password:
+                auth_conf.append({'type': 'legacy_api_password'})
+
         setattr(hass, 'auth', await auth.auth_manager_from_config(
             hass,
-            config.get(CONF_AUTH_PROVIDERS, []),
+            auth_conf,
             config.get(CONF_AUTH_MFA_MODULES, [])))
 
     hac = hass.config
diff --git a/tests/test_config.py b/tests/test_config.py
index 435d3a00ec2146..77a30fd771b358 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -812,6 +812,47 @@ async def test_auth_provider_config(hass):
     await config_util.async_process_ha_core_config(hass, core_config)
 
     assert len(hass.auth.auth_providers) == 2
+    assert hass.auth.auth_providers[0].type == 'homeassistant'
+    assert hass.auth.auth_providers[1].type == 'legacy_api_password'
+    assert hass.auth.active is True
+
+
+async def test_auth_provider_config_default(hass):
+    """Test loading default auth provider config."""
+    core_config = {
+        'latitude': 60,
+        'longitude': 50,
+        'elevation': 25,
+        'name': 'Huis',
+        CONF_UNIT_SYSTEM: CONF_UNIT_SYSTEM_IMPERIAL,
+        'time_zone': 'GMT',
+    }
+    if hasattr(hass, 'auth'):
+        del hass.auth
+    await config_util.async_process_ha_core_config(hass, core_config)
+
+    assert len(hass.auth.auth_providers) == 1
+    assert hass.auth.auth_providers[0].type == 'homeassistant'
+    assert hass.auth.active is True
+
+
+async def test_auth_provider_config_default_api_password(hass):
+    """Test loading default auth provider config with api password."""
+    core_config = {
+        'latitude': 60,
+        'longitude': 50,
+        'elevation': 25,
+        'name': 'Huis',
+        CONF_UNIT_SYSTEM: CONF_UNIT_SYSTEM_IMPERIAL,
+        'time_zone': 'GMT',
+    }
+    if hasattr(hass, 'auth'):
+        del hass.auth
+    await config_util.async_process_ha_core_config(hass, core_config, True)
+
+    assert len(hass.auth.auth_providers) == 2
+    assert hass.auth.auth_providers[0].type == 'homeassistant'
+    assert hass.auth.auth_providers[1].type == 'legacy_api_password'
     assert hass.auth.active is True