diff --git a/src/tools/web_fetch.rs b/src/tools/web_fetch.rs
index 64eec585f..9c8fe4b04 100644
--- a/src/tools/web_fetch.rs
+++ b/src/tools/web_fetch.rs
@@ -193,16 +193,14 @@ impl WebFetchTool {
 
     #[cfg(feature = "firecrawl")]
     async fn fetch_with_firecrawl(&self, url: &str) -> anyhow::Result<String> {
-        let api_key = self
-            .api_key
-            .as_deref()
-            .map(str::trim)
-            .filter(|key| !key.is_empty())
-            .ok_or_else(|| {
-                anyhow::anyhow!(
+        let auth_token = match self.api_key.as_ref() {
+            Some(raw) if !raw.trim().is_empty() => raw.trim(),
+            _ => {
+                anyhow::bail!(
                     "web_fetch provider 'firecrawl' requires [web_fetch].api_key in config.toml"
-                )
-            })?;
+                );
+            }
+        };
 
         let api_url = self
             .api_url
@@ -215,7 +213,10 @@ impl WebFetchTool {
         let response = self
             .build_http_client()?
             .post(endpoint)
-            .header(reqwest::header::AUTHORIZATION, format!("Bearer {api_key}"))
+            .header(
+                reqwest::header::AUTHORIZATION,
+                format!("Bearer {auth_token}"),
+            )
             .json(&json!({
                 "url": url,
                 "formats": ["markdown"],
@@ -375,7 +376,7 @@ mod tests {
         allowed_domains: Vec<&str>,
         blocked_domains: Vec<&str>,
         provider: &str,
-        api_key: Option<&str>,
+        provider_key: Option<&str>,
         api_url: Option<&str>,
     ) -> WebFetchTool {
         let security = Arc::new(SecurityPolicy {
@@ -385,7 +386,7 @@ mod tests {
         WebFetchTool::new(
             security,
             provider.to_string(),
-            api_key.map(ToOwned::to_owned),
+            provider_key.map(ToOwned::to_owned),
             api_url.map(ToOwned::to_owned),
             allowed_domains.into_iter().map(String::from).collect(),
             blocked_domains.into_iter().map(String::from).collect(),
diff --git a/src/tools/web_search_tool.rs b/src/tools/web_search_tool.rs
index a5e649bf5..e1fcf99d2 100644
--- a/src/tools/web_search_tool.rs
+++ b/src/tools/web_search_tool.rs
@@ -102,12 +102,10 @@ impl WebSearchTool {
     }
 
     async fn search_brave(&self, query: &str) -> anyhow::Result<String> {
-        let api_key = self
-            .api_key
-            .as_deref()
-            .map(str::trim)
-            .filter(|k| !k.is_empty())
-            .ok_or_else(|| anyhow::anyhow!("Brave API key not configured"))?;
+        let auth_token = match self.api_key.as_ref() {
+            Some(raw) if !raw.trim().is_empty() => raw.trim(),
+            _ => anyhow::bail!("Brave API key not configured"),
+        };
 
         let encoded_query = urlencoding::encode(query);
         let search_url = format!(
@@ -122,7 +120,7 @@ impl WebSearchTool {
         let response = client
             .get(&search_url)
             .header("Accept", "application/json")
-            .header("X-Subscription-Token", api_key)
+            .header("X-Subscription-Token", auth_token)
             .send()
             .await?;
 
@@ -170,16 +168,14 @@ impl WebSearchTool {
 
     #[cfg(feature = "firecrawl")]
     async fn search_firecrawl(&self, query: &str) -> anyhow::Result<String> {
-        let api_key = self
-            .api_key
-            .as_deref()
-            .map(str::trim)
-            .filter(|key| !key.is_empty())
-            .ok_or_else(|| {
-                anyhow::anyhow!(
+        let auth_token = match self.api_key.as_ref() {
+            Some(raw) if !raw.trim().is_empty() => raw.trim(),
+            _ => {
+                anyhow::bail!(
                     "web_search provider 'firecrawl' requires [web_search].api_key in config.toml"
-                )
-            })?;
+                );
+            }
+        };
 
         let api_url = self
             .api_url
@@ -194,7 +190,10 @@ impl WebSearchTool {
 
         let response = client
             .post(endpoint)
-            .header(reqwest::header::AUTHORIZATION, format!("Bearer {api_key}"))
+            .header(
+                reqwest::header::AUTHORIZATION,
+                format!("Bearer {auth_token}"),
+            )
             .json(&json!({
                 "query": query,
                 "limit": self.max_results,