A volley of rockets targeting an airbase in Iraq's Kurdistan region killed a foreign civilian contractor and wounded five others and a US soldier, the US-led coalition said.
The attack late Monday was the first time in nearly two months that Western military or diplomatic installations have been targeted in Iraq, after a string of similar incidents.
US Secretary of State Antony Blinken called for an investigation and promised to "hold accountable those responsible".
"Several American contractors" appeared to have been wounded he added, without giving further details.
Former US president Donald Trump had threatened that the killing of an American national in such a rocket attack would prompt a mass bombing campaign in Iraq.
Iraqi and Western security sources told AFP that at least three rockets were fired in the direction of the city's airport, where foreign troops are based as part of an international alliance fighting the Islamic State group.
Coalition spokesman Colonel Wayne Marotto confirmed to AFP that the dead contractor was not Iraqi, but could not give immediate details on the victim's nationality.
Since Iraq declared victory against IS in late 2017, the coalition has been reduced to under 3,500 troops in total, 2,500 of them Americans.
Most are concentrated at the military complex at the Arbil airport, a coalition source told AFP.
The attack was claimed by a shadowy group calling itself "Awliyaa al-Dam" or "Guardians of Blood".
Around a dozen such groups have cropped up in the past year claiming rocket attacks, but US and Iraqi security officials have told AFP they believe them to be front groups for prominent pro-Iran factions including Kataeb Hezbollah and Asaib Ahl al-Haq.
Two other rockets hit residential neighbourhoods on Arbil's outskirts.
Delovan Jalal, the head of Arbil's health directorate, told AFP at least five civilians were wounded and one was in critical condition.
The Kurdistan region's interior ministry confirmed "several rockets" had hit the city and said security agencies had launched a "detailed investigation", urging civilians to stay home until further notice.
Following the attack, security forces deployed around the airport and helicopters could be heard on the city's edges, an AFP correspondent said.
Iraqi President Barham Saleh tweeted that the attack marked a "dangerous escalation and a criminal terrorist act".
Masrour Barzani, prime minister of the autonomous Kurdish region, condemned the attack "in the strongest terms".
Two intelligence sources confirmed to AFP that the attack was carried out from within the autonomous Kurdish region.
Western military and diplomatic sites have been targeted by dozens of rockets and roadside bombs since late 2019, with both foreign and Iraqi personnel killed.
In December 2019, a US contractor was killed in a rocket attack on a base in Kirkuk province, prompting the US to respond with air strikes against Kataeb Hezbollah.
In March 2020, another rocket attack killed two Americans -- a soldier and a contractor -- and a British soldier.
In October, the US threatened to close its embassy in Baghdad unless the attacks stopped.
The Iraqi government facilitated an indefinite truce with hardline groups and the fire had come to a near halt.
But there have been violations, the most recent of which had been a spray of rockets targeting the US embassy on December 20.
Arbil has been targeted very rarely, although Iranian forces fired missiles at the same airport in January 2020, a few days after Washington assassinated key general Qasem Soleimani at Baghdad airport.