Citing CCTV footage from the scene, East Java Police spokesman Frans Barung Mangera said a man and a woman on the bike stopped at the security checkpoint.
"That's where the explosion happened," he added.
"Two people were riding (on the motorcycle) and a woman was sitting at the back."
The authorities said the wounded included six civilians and four police.
Ambulances and the bomb squad descended on the chaotic scene with the CCTV images showed the mangled wreckage of a motorbike at the security gate at the headquarters in the heart of the city.
There was no immediate claim of responsibility after the latest suicide bombing.
"This is a cowardly act, undignified and inhumane," Indonesian President Joko Widodo told reporters in Jakarta.
"There will be no compromise in taking action on the ground to stop terrorism."
The lethal explosion comes just a day after a family of six including two young daughters staged suicide bombings at three churches in Surabaya during Sunday services.
At least 14 civilians have died as a result of that attack, which was claimed by the Islamic State group, and the toll could climb with more than 40 injured in hospital.
The archipelago nation of some 17,000 islands has long struggled with Islamic militancy, including the 2002 Bali bombings that killed 202 people -- mostly foreign tourists -- in the country's worst-ever terror attack.
Sunday's church bombings was Indonesia's deadliest attack in years. The attackers -- a mother and father, two daughters aged nine and 12, and two sons aged 16 and 18 -- were linked to local extremist network Jamaah Ansharut Daulah (JAD) which supports IS, police have said.
A further three people in another family were killed and two wounded when another bomb exploded at an apartment complex about 30 kilometres (20 miles) from Surabaya, just hours later, police said.
The mother and one child died from the explosion while police said they shot dead the father who was carrying a bomb detonator.
Two other children were injured in the blast and were taken to hospital.
There was no immediate claim of responsibility for the apartment bomb.
In the church attacks, the mother, identified as Puji Kuswati, and her two daughters were wearing niqab face veils and had bombs strapped to their waists as they entered the grounds of the Kristen Indonesia Diponegoro Church and blew themselves up, police have said.
The father, JAD cell leader Dita Priyanto, drove a bomb-laden car into the Surabaya Centre Pentecostal Church while his sons rode motorcycles into Santa Maria church, where they detonated explosives they were carrying, according to authorities.
JAD, led by jailed radical Aman Abdurrahman, has been linked to several deadly incidents, including a 2016 gun and suicide attack in the capital Jakarta that left four attackers and four civilians dead.
That was the first assault claimed by IS in Southeast Asia.
Police on Sunday said four suspected JAD members were killed in a shootout during raids linked to a deadly prison riot this week.
Five members of Indonesia's elite anti-terrorism squad and a prisoner were killed in clashes that saw Islamist inmates take a guard hostage at a high-security jail on the outskirts of Jakarta. IS claimed responsibility.
Karnavian said Sunday's church attacks may have been revenge for the arrest of some of JAD's leaders and for the prison crisis which eventually saw the surrender of the radical inmates.
(Except for the headline, this story has not been edited by NDTV staff and is published from a syndicated feed.)
Get Breaking news, live coverage, and Latest News from India and around the world on NDTV.com. Catch all the Live TV action on NDTV 24x7 and NDTV India. Like us on Facebook or follow us on Twitter and Instagram for latest news and live news updates.