diff --git a/controller/daemon/api.go b/controller/daemon/api.go
index 8b9268fb7..2dbeb902f 100644
--- a/controller/daemon/api.go
+++ b/controller/daemon/api.go
@@ -12,13 +12,6 @@ import (
 )
 
 func (r *ReefPi) API() error {
-	_, err := r.a.GetCredentials()
-	if err != nil {
-		log.Println("ERROR: Failed to load credentials. Error", err)
-		if err := r.a.DefaultCredentials(); err != nil {
-			return err
-		}
-	}
 	err, router := startAPIServer(r.settings.Address, r.settings.HTTPS)
 	if err != nil {
 		return err
diff --git a/controller/daemon/api_test.go b/controller/daemon/api_test.go
index c5122a3b0..bde44c9e0 100644
--- a/controller/daemon/api_test.go
+++ b/controller/daemon/api_test.go
@@ -43,7 +43,10 @@ func TestAPI(t *testing.T) {
 		t.Error("Failed to get per minute health data.Error:", err)
 	}
 	body := new(bytes.Buffer)
-	json.NewEncoder(body).Encode(&DefaultCredentials)
+	json.NewEncoder(body).Encode(utils.Credentials{
+		User:     "reef-pi",
+		Password: "reef-pi",
+	})
 	if err := tr.Do("POST", "/api/credentials", body, nil); err != nil {
 		t.Error("Failed to update creds via api")
 	}
diff --git a/controller/daemon/capabilities_test.go b/controller/daemon/capabilities_test.go
index 7663b9c87..f8907c8a2 100644
--- a/controller/daemon/capabilities_test.go
+++ b/controller/daemon/capabilities_test.go
@@ -19,13 +19,24 @@ func Test_Capabilities(t *testing.T) {
 	http.DefaultServeMux = new(http.ServeMux)
 	store, err := storage.NewStore("capabilities-test.db")
 	defer store.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
 
+	err = store.CreateBucket(Bucket)
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	tele := telemetry.TestTelemetry(store)
+
+	auth, err := utils.NewAuth(Bucket, store)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	r := &ReefPi{
-		a:          utils.NewAuth(Bucket, store),
+		a:          auth,
 		telemetry:  tele,
 		dm:         device_manager.New(settings.DefaultSettings, store, tele),
 		subsystems: controller.NewSubsystemComposite(),
diff --git a/controller/daemon/reef_pi.go b/controller/daemon/reef_pi.go
index 53c06ef0c..1f3a6b2c1 100644
--- a/controller/daemon/reef_pi.go
+++ b/controller/daemon/reef_pi.go
@@ -43,13 +43,19 @@ func New(version, database string) (*ReefPi, error) {
 	}
 	fn := func(t, m string) error { return logError(store, t, m) }
 	tele := telemetry.Initialize(s.Name, Bucket, store, fn, s.Prometheus)
+
+	auth, err := utils.NewAuth(Bucket, store)
+	if err != nil {
+		return nil, err
+	}
+
 	r := &ReefPi{
 		store:      store,
 		settings:   s,
 		telemetry:  tele,
 		subsystems: controller.NewSubsystemComposite(),
 		version:    version,
-		a:          utils.NewAuth(Bucket, store),
+		a:          auth,
 		dm:         device_manager.New(s, store, tele),
 	}
 	if s.Capabilities.HealthCheck {
diff --git a/controller/utils/auth.go b/controller/utils/auth.go
index cd63cebd0..8e8c26f2e 100644
--- a/controller/utils/auth.go
+++ b/controller/utils/auth.go
@@ -60,11 +60,9 @@ func (cs *CredentialsManager) Validate(credentials Credentials) (bool, error) {
 type Auth interface {
 	SignIn(http.ResponseWriter, *http.Request)
 	SignOut(http.ResponseWriter, *http.Request)
-	GetCredentials() (Credentials, error)
 	UpdateCredentials(http.ResponseWriter, *http.Request)
 	Me(http.ResponseWriter, *http.Request)
 	Authenticate(http.HandlerFunc) http.HandlerFunc
-	DefaultCredentials() error
 }
 
 type auth struct {
@@ -72,11 +70,23 @@ type auth struct {
 	cookiejar          *sessions.CookieStore
 }
 
-func NewAuth(b string, store storage.Store) Auth {
-	return &auth{
+func NewAuth(b string, store storage.Store) (Auth, error) {
+	a := &auth{
 		credentialsManager: NewCredentialsManager(store, b),
 		cookiejar:          sessions.NewCookieStore([]byte("reef-pi-key")),
 	}
+
+	_, err := a.getCredentials()
+	if err != nil {
+		log.Println("ERROR: Failed to load credentials. Error", err)
+		log.Println("WARNING: Setting default credentials")
+		if err := a.defaultCredentials(); err != nil {
+			log.Println("ERROR: Failed to set default credentials. Error", err)
+			return nil, err
+		}
+	}
+
+	return a, nil
 }
 
 func (a *auth) Authenticate(fn http.HandlerFunc) http.HandlerFunc {
@@ -145,7 +155,7 @@ func (a *auth) SignOut(w http.ResponseWriter, req *http.Request) {
 	log.Println("Sign out:", req.RemoteAddr)
 }
 
-func (a *auth) GetCredentials() (Credentials, error) {
+func (a *auth) getCredentials() (Credentials, error) {
 	return a.credentialsManager.Get()
 }
 
@@ -157,7 +167,7 @@ func (a *auth) UpdateCredentials(w http.ResponseWriter, req *http.Request) {
 	JSONUpdateResponse(&credentials, fn, w, req)
 }
 
-func (a *auth) DefaultCredentials() error {
+func (a *auth) defaultCredentials() error {
 	return a.credentialsManager.Update(Credentials{
 		User:     "reef-pi",
 		Password: "reef-pi",
diff --git a/controller/utils/auth_test.go b/controller/utils/auth_test.go
index c6ff072a3..3a33c3499 100644
--- a/controller/utils/auth_test.go
+++ b/controller/utils/auth_test.go
@@ -18,7 +18,10 @@ func TestAuth(t *testing.T) {
 	}
 	store.CreateBucket("reef-pi")
 	store.Update("reef-pi", "credentials", creds)
-	r := NewAuth("reef-pi", store)
+	r, err := NewAuth("reef-pi", store)
+	if err != nil {
+		t.Fatal(err)
+	}
 	tr := NewTestRouter()
 	tr.Router.HandleFunc("/sign_in", r.SignIn).Methods("GET")
 	tr.Router.HandleFunc("/sign_out", r.SignOut).Methods("GET")