The Islamic State group has claimed responsibility after a Syrian blew himself up outside a wine bar, injuring 15 people.
The man, whose asylum bid was rejected in Germany, recorded a mobile phone video of himself pledging allegiance to the group before he tried to get into an outdoor concert with a bomb-laden backpack.
He was turned away and blew himself up outside a wine bar instead, said authorities.
It was the fourth attack to shake Germany in a week - three of them carried out by recent migrants.
The 27-year-old, who authorities have not identified, set off a backpack laden with explosives and shrapnel on Sunday night after being refused entry to the nearby festival in the Bavarian city of Ansbach because he did not have a ticket.
Bavarian authorities said a video found on the Ansbach bomber's phone showed him pledging allegiance to the Islamic State.
Germany's top security official, interior minister Thomas de Maiziere, said it was too early to rule out terrorism as a motive, but noted that the suspect had twice attempted suicide and had been receiving psychological care.
"Or it could be a combination of both," said Mr de Maiziere.
The attack was carried out by "one of the soldiers of the Islamic State," said the extremist group.
The IS-linked Aamaq news agency said the man carried out the attack in response to calls by the group to target countries of the US-led coalition that is fighting IS.
The bombing was the latest of the recent attacks that have heightened concerns about how Germany can deal with the estimated one million migrants who entered the country last year.
Those fears waned as the numbers of new arrivals had slowed this year dramatically, but already the nationalist Alternative for Germany party and others have seized on the attacks as evidence that Chancellor Angela Merkel's migration policies are flawed.
A 17-year-old Afghan asylum-seeker injured five with an axe before being killed by police near Wuerzburg last week in an attack that was claimed by Islamic State.
On Sunday, a Syrian man killed a woman with a knife in the south-west city of Reutlingen before being captured by police in an incident that authorities said was not likely to be linked to terrorism.
In between, the 18-year-old son of Iranian asylum seekers went on a rampage Friday night at a Munich mall, killing nine and wounding dozens. Authorities say he was undergoing psychological treatment and had no known links to terrorism.
The attack in Ansbach, a serene city of about 40,000 west of Nuremberg, came near the end of the closing night of a popular open air festival being attended by about 2,000 people.
Following the Munich mall shooting, city officials ordered extra security and bag checks at the entrance of the venue, but the man never got that far, being turned away for lack of a ticket, said Mayor Carda Seidel.
Roman Fertinger, the deputy police chief in Nuremberg, said there likely would have been more casualties if the man had not been turned away.
Four of the 15 victims suffered serious injuries.
"My personal view is that I unfortunately think it's very likely this really was an Islamist suicide attack," said Bavarian interior minister Joachim Herrmann.
Mr Herrmann said the man's request for asylum was rejected a year ago, and a spokesman for Germany's interior ministry said he had received two deportation notices.
Tobias Plate said the man was told on July 13 that he would be deported to Bulgaria, where he submitted his first asylum request.
Mr Plate told reporters that the first deportation notice was issued on December 22 2014, but it was not clear why he had not been deported then.
Asylum-seekers are routinely deported to the first country where they registered if they do not follow proper procedures, even if they're considered to have a legitimate claim for asylum.
The unidentified man had repeatedly received psychiatric treatment, including twice for attempted suicide, authorities said, and had been known to police for drug possession.
Authorities on Monday morning raided the asylum shelter where he lived in the suburbs of Ansbach and searched his room.
One resident there said he had occasionally drunk coffee with the attacker and they had discussed religion. Alireza Khodadadi said the man, whom he would identify only as Mohammed, told him that the extremist Islamic State group was not representative of Islam.
"He always said that, no, I'm not with them, I don't like them and such stuff.
"But I think he had some issues because, you know, he told lies so often without any reason, and I understand that he wants to be in the centre of (attention), you know, he needed (attention)," said Mr Khodadadi.
A team of 30 investigators was interviewing the man's acquaintances and examining evidence collected from his home.
Meantime, in Munich on Sunday evening, 1,500 people gathered at the scene of the shooting there, lighting candles and placing flowers in tribute to the victims of an 18-year-old German-Iranian. Police said that he had planned the attack for a year.
Munich authorities said on Monday at a news conference that a 16-year-old Afghan friend of the Munich attacker may have known of the attack in advance.
Police said on Monday the teenager was arrested late on Sunday and investigators were able to retrieve a deleted chat between him and the attacker on the messaging app WhatsApp.
Police say the chat appears to show that the 16-year-old met with the attacker immediately before the shooting started, and knew the attacker had a pistol.
Investigators say the teenagers met last year as in-patients at a psychiatric ward. Both were being treated for online game addiction, among other things.