President Donald Trump used the attack to call for tougher USA immigration rules, saying the current "lax" policy "allows far too many unsafe, inadequately vetted people to access our country".
The New York Police said Ullah made the bomb at the electrical company where he works.
Authorities evacuated the Port Authority Bus Terminal after the explosion, snarling morning commutes and throwing Manhattan's midtown into disarray. That license, which was not for a New York City cab, but instead for a so-called "for-hire" vehicle, lapsed in March 2015.
The device was based on a pipe bomb and affixed to the suspect's body with a combination of velcro and zip ties, said John Miller, the deputy commissioner of intelligence and counter-terrorism for the NYPD.
"There are also no credible and specific threats against New York City at this time", New York City Mayor Bill de Blasio said Monday morning.
He added that there are no additional known incidents or activities at this time. A city official told New York Times that a surveillance camera recorded the explosion.
The explosive device was found on a subway platform, Fox News reported, citing police. "Everybody was scared and running and shouting". Avoid the area. Subways bypassing #PortAuthority and Times Square Stations.
Terrorism suspect in custody following NYC explosion
"It took about four minutes before men in black cop uniforms started shooing people out of Port Authority".
"A woman fell, and nobody even stopped to help her because it was so insane", she said.
The suspect, 27-year-old Akayed Ullah who had been living in Brooklyn, suffered burns to his hands and abdomen, and was in a serious condition at Bellevue Hospital Center.
Members of the New York City Police Department stand guard inside the New York Port Authority Bus Terminal following an explosion, December 11, 2017.
On a typical weekday, about 220,000 passengers arrive or depart from the terminal on more than 7000 buses.
President Donald Trump has been briefed on the incident, White House spokeswoman Sarah Huckabee Sanders told reporters.
On the West Coast, the Los Angeles County Metropolitan Transportation authority asked law enforcement for heightened security along bus and rail lines as a precaution.