A cellular video obtained by The Associated Press showed body parts scattered near a burning motorbike at the gates of the Sacred Heart of Jesus Cathedral in Makassar, the capital of South Sulawesi province.
The attack came as Indonesia was on high alert following the arrest of Aris Sumarsono, known as Zulkarnaen, the leader of Jemaah Islamiyah, in December.
Wilhelmus Tulak, a Catholic priest who was leading the Mass when the bomb exploded at about 10:30 a.m., told reporters that a loud bang shocked his congregation, who had just finished the Sunday service marking the beginning of the Holy Week before Easter.
The first group of churchgoers was walking out of the church while another group was coming in when the blast happened, he said.
He said security guards suspected two motorists who wanted to enter the church. One of them detonated his explosives and died near the gate after being confronted by guards. The wounded included four guards and several churchgoers.
National Police spokesperson Argo Yuwono said at a news conference in the capital, Jakarta, that police were still trying to identify two attackers on a motorbike who used powerful explosives.
He said police were investigating whether they were linked to a local affiliate of the banned Jemaah Islamiyah network or were acting independently.
About 64 suspects have been detained by Indonesia's counterterrorism squad, known as Densus 88, in several provinces, including 19 last month in Makassar. The arrests followed a tipoff about possible attacks against police and places of worship.
Download the NBC News app for breaking news and politics
Indonesia, the world's most populous Muslim-majority country, has been battling militants since bombings on the resort island of Bali in 2002 killed 202 people, most of them foreign tourists. Attacks aimed at foreigners have largely been replaced in recent years by smaller, less deadly strikes targeting the government, police, anti-terrorism forces and people whom militants consider as infidels.
A court banned Jemaah Islamiyah in 2008, and the group was weakened by a sustained crackdown. A new threat has emerged in recent years inspired by the Islamic State group's attacks abroad.
The country's last major attack was in May 2018, when two families carried out suicide bombings in the second-largest city, Surabaya, killing a dozen people, including two young girls, whose parents had involved them in one of the attacks. Police said the father was the leader of a local affiliate of the Islamic State group known as Jemaah Anshorut Daulah.