I'm working on a unit tests for an API client class. 
There is a class variable self.session that is supposed to hold the session. 
In my setup method for my test I create a new instance of the client class and then call its authenticate method. However when the tests themselves go to send requests using this object they all return 401 forbidden errors. 
If I move the authenticate call (but not the creation of the class) into the tests and out of setup everything works great, but I understand that that defeats the purpose of setup().
An example of the code you're talking about (with proprietary stuff removed, of course), might help clarify.
The variable, self.session, is on the test class itself, rather than the instance?  That sounds as if it might end up leaking state between your tests.  Attaching it to the instance might help.
Beyond that, I generally think it makes sense to move as much out of setUp methods as possible.  Authentication is part of the important part of your test, and it should probably be done alongside all the other logic.
Lifetime of Request Sessions in Unit Testing