diff --git a/src/bin/keactrl/kea-ctrl-agent.conf.pre b/src/bin/keactrl/kea-ctrl-agent.conf.pre
index e6ae8b8a..f7e3fed2 100644
--- a/src/bin/keactrl/kea-ctrl-agent.conf.pre
+++ b/src/bin/keactrl/kea-ctrl-agent.conf.pre
@@ -26,6 +26,18 @@
     // is specifically for HA updates only.
     "http-port": 8000,
 
+    "authentication": {
+        "type": "basic",
+        "realm": "Kea Control Agent",
+        "directory": "/etc/kea",
+        "clients": [
+            {
+                "user": "kea-api",
+                "password-file": "kea-api-password"
+            }
+        ]
+    },
+
     // Specify location of the files to which the Control Agent
     // should connect to forward commands to the DHCPv4, DHCPv6
     // and D2 servers via unix domain sockets.