The suspected bomber, a 24-year-old Algerian citizen, was arrested along with his mother and father and another Algerian student who is a family friend, Paris prosecutors said in a statement.
The suspect is an IT student previously unknown to police, Lyon's mayor Gerard Collomb said.
Police have also questioned his sister but she has not been arrested, the Paris prosecutors added.
Prosecutors had on Friday opened an investigation over “attempted murders linked to a terrorist organisation”.
Police had been hunting for a man seen cycling near the scene of the blast who was wearing a green top and Bermuda shorts, and carrying a dark rucksack.
He had been the target of an extensive manhunt since late Friday when an explosive device filled with screws and ball bearings was placed in front of a bakery near the corner of two crowded pedestrian streets in the historic centre of Lyon.
Police circulated photos of the suspect on Twitter, leading to “several dozen” calls from people with information.
Sources close to the investigation suspected the explosive was acetone peroxide, or APEX, a volatile compound used in deadly Paris attacks that happened on November 13, 2015.
Investigators recovered small screws, ball bearings and batteries along with a printed circuit and a remote-controlled trigger device. Officials later said the charge was relatively weak.
Thirteen people were wounded in the blast – eight women, four men and a 10-year-old girl – of whom 11 needed hospital treatment.
None of their injuries is believed to be life-threatening, but authorities said some needed surgery to remove shrapnel.
“There was an explosion and I thought it was a car crash,” said Eva, a 17-year-old student who was about 15 metres from the site of the blast, which was on the narrow strip of land between the Saone and Rhone rivers in the historic city centre.
“There were bits of electric wire near me, and batteries and bits of cardboard and plastic. The windows were blown out.”
“It's an area in the very centre of Lyon, a major street,” the city's deputy mayor in charge of security, Jean-Yves Secheresse, told BFM television.
“These areas are highly secured, the police are continually present,” as were patrols by soldiers deployed in a long-running anti-terror operation, he said.
France has been on high alert following a wave of deadly jihadist terror attacks since 2015 which have killed more than 250 people.
The Islamic State group has been behind many of the attacks. No one has claimed responsibility for the Lyon blast.A planned concert by British singer Ed Sheeran went ahead in Lyon on Friday night, albeit with heightened security.