Add this code to your theme’s functions.php file or a custom plugin, not directly to the WordPress core files.
// Restrict Application Passwords feature to administrators only
function my_prefix_customize_app_password_availability($available, $user) {
// Allow only users with the 'manage_options' capability (typically admins)
return user_can($user, 'manage_options');
}
add_filter('wp_is_application_passwords_available_for_user', 'my_prefix_customize_app_password_availability', 10, 2);