A blast at a shopping complex in Kenya's capital, Nairobi, that injured 33 people on Monday was caused by an explosive device, the police have said.
There had been confusion over its cause - officers first blamed it on an electrical fault, but the prime minister said it had a terrorist link.
Police now say they are hunting for two male suspects one of whom may be a German or Turkish national.
The police spokesman said one suspect may have entered Kenya from Somalia.
The militant group al-Shabab has repeatedly threatened to stage revenge attacks after Kenya sent troops to Somalia in October 2011.
In recent months, al-Shabab has claimed responsibility for a string of grenade and bomb blasts across Kenya, that have killed several people.
Monday's explosion tore apart a shopping centre on Moi Avenue at lunchtime.
One witness said a bag was abandoned next to her just before the explosion.
In Tuesday's statement, Kenya police spokesman Eric Kiraithe said the blast was "caused by an improvised explosive device planted in the building by criminal elements".
"The team has been able to recover several materials from the scene of the explosion which has been sent for forensic analysis to determine the composition of the explosive and its method of initiation," he said.
Mr Kiraithe appealed for the public to come forward with information and said one of the suspects may have entered Kenya through the border town of Garissa.
Prime Minister Raila Odinga visited the bomb site on Monday and said it the explosion had been a "heinous act of terrorism".
"We are under threat, but we will not be cowed," he said.
Earlier this year, the African Union force backing Somalia's interim government was boosted from 12,000 troops to nearly 18,000 to incorporate Kenyan troops which entered Somalia last October in pursuit of al-Shabab militants.
They accuse the Islamist fighters of being behind various kidnappings on Kenyan soil and of destabilising the border region.