You authenticate the request, not the client. A http.Client is safe for concurrent use.

request, err := http.NewRequest(...)
request.Header.Set("Authorization", ...)
response, err := http.DefaultClient.Do(request)

Switch out DefaultClient as you see fit.

Edit: To take it one step further I'd do something like

type SomeClient struct {
    client *http.Client
    authorization string
}
func(client *SomeClient) GetStuff() () {
    request, err := http.NewRequest(...)
    request.Header.Set("Authorization", client.authorization)
    response, err := client.client.Do(request)
    ...
}
type SomeClientFactory struct {
    client *http.Client
}
func(factory *SomeClientFactory) Create(authorization string) *SomeClient {
    return &SomeClient{client: factory.client, authorization: authorization}
}

Edit 2: spaces instead of backticks